joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c1ae
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008638c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006a3e3
mov dword [ebp - 0x14], eax
cmp dword [0x10672d68], esi
jne 0x1007c2a1
push 0x800
push esi
push 0x10007d78
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007c22e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007c381
push esi
push esi
push 0x10007d78
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007c381
push 0x10007d90
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007c381
push eax
call ebx
push 0x10007d9c
push edi
mov dword [0x10672d68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007dac
push edi
mov dword [0x10672d6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007dc0
push edi
mov dword [0x10672d70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10672d78], eax
test eax, eax
je 0x1007c29e
push 0x10007ddc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10672d74], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007c2c6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007c2b9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007c2db
push 4
pop eax
jmp 0x1007c383
cmp dword [ebp - 0x14], esi
je 0x1007c2db
push dword [0x10672d68]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007c2c0
mov eax, dword [0x10672d74]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007c339
cmp dword [0x10672d78], edi
je 0x1007c339
push eax
call ebx
push dword [0x10672d78]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007c339
test eax, eax
je 0x1007c339
call ecx
test eax, eax
je 0x1007c32e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007c32e
test byte [ebp - 8], 1
jne 0x1007c339
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007c369
mov eax, dword [0x10672d6c]
cmp eax, edi
je 0x1007c366
push eax
call ebx
test eax, eax
je 0x1007c366
call eax
mov esi, eax
test esi, esi
je 0x1007c366
mov eax, dword [0x10672d70]
cmp eax, edi
je 0x1007c366
push eax
call ebx
test eax, eax
je 0x1007c366
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10672d68]
call ebx
test eax, eax
je 0x1007c381
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007c383
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x304e4e7e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x330d3b15
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402634
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00403872
push 0
push 0x61
mov ecx, edi
call fcn.00406770
mov ecx, dword [ebp + 0xc]
call fcn.004193a0
mov edx, 0xce4
lea ecx, [ebp - 0xc]
call fcn.00402693
push dword [eax]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0xc]
call fcn.004031e3
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
leave
ret 8

Function at 0x402a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41a04e
call fcn.004197d0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.0040372d
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402a9a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402aec
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41a099
call fcn.004197d0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040a904
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402b42
push dword [esi + 0x24]
call fcn.004031e3
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00411e2d
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402ec0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x404699
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x404804
Capabilities:
Create directory

Disassembly:
mov eax, 0x41a2d0
call fcn.004197d0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404827
mov al, 1
jmp 0x40486d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404838
xor al, al
jmp 0x40486d
lea ecx, [ebp - 0x44]
call fcn.00404e49
lea ecx, [ebp - 0x1c]
call fcn.0040372d
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00405100
test al, al
je 0x404862
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.004031e3
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4050f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4050ff
or eax, eax
ret
Function at 0x405751
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40577b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40577b
xor al, al
jmp 0x40579b
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00419b00
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x40af30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41a8b5
call fcn.004197d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.0040372d
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0040372d
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.0040372d
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.00402a9a
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00402a9a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40b174
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x41a936
call fcn.004197d0
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x41bd1c
mov dword [esi + 4], 0x41bd08
mov dword [esi + 8], 0x41bcf8
mov dword [esi + 0xc], 0x41bce4
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
call fcn.0040372d
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.0040372d
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00404e49
lea ecx, [edi + 0x28]
call fcn.0040372d
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.004086fd
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41bcd0
mov dword [esi + 4], 0x41bcbc
mov dword [esi + 8], 0x41bcac
mov dword [esi + 0xc], 0x41bc98
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40b49e
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x41a9f5
call fcn.004197d0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x40b4c2
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x40b4d6
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x40b4ea
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x40b4fe
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.004037e0
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.004037e0
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.004037e0
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.0040b5fd
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.0040b5fd
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x414d20
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x414d5d
push str.SetDefaultDllDirectories
push 0x41b8f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414d5d
push 0xc00
call eax
test eax, eax
jne 0x414df6
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x414df6
cmp eax, 0x104
ja 0x414df6
cmp word [esp + eax*2 + 6], 0x5c
je 0x414d8c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x414df6
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x414dcb
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x414db7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x414dac
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x4185f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x41865b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x41869c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x418681
mov ecx, ebx
call fcn.004182e0
add ebx, 0x28
dec ebp
jne 0x418675
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x418697
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00418210
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.00418740
mov ebx, eax
cmp ebx, edi
jne 0x4186ff
lea ecx, [ebp + 0x20]
call fcn.00419440
mov ebx, eax
cmp ebx, edi
jne 0x4186ff
lea ecx, [ebp + 0x1c]
call fcn.00419440
mov ebx, eax
cmp ebx, edi
jne 0x4186ff
push ebp
call fcn.00418780
mov ebx, eax
cmp ebx, edi
je 0x418714
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.00418760
cmp ebx, edi
jle 0x41870f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x418714
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x418726
cmp dword [esi + 0x40], edi
jne 0x418726
cmp dword [esi + 0x3c], edi
jne 0x418726
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x419400
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x419428
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x419437
mov eax, 1
ret 4
Function at 0x40195b
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040df60
mov eax, 0x416107
mov dword [0x41702c], eax
mov dword [esp], 0
jmp 0x40197c
mov eax, 3
cmp eax, dword [esp]
jl 0x4019ea
mov eax, dword [0x41702c]
movsx eax, byte [eax]
mov dword [esp + 4], eax
inc dword [0x41702c]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
mov ebx, dword [esp + 0xc]
imul ebx, ebx, 0xffffffff
push ebx
call fcn.00405d60
lea eax, [esp + 0xc]
push eax
call fcn.0040de60
mov edx, dword [esp + 0xc]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040dfc0
mov edx, dword [esp + 0xc]
push edx
call fcn.0040dfc0
lea eax, [esp + 0x10]
push eax
call fcn.0040de60
inc dword [esp]
jno 0x40197c
push 0x400
call fcn.00409b40
mov dword [esp + 0x10], eax
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
call fcn.0040a6f6
lea eax, [esp + 0x18]
push eax
call fcn.0040de60
push dword [esp + 0x10]
push 0
mov eax, 0x416020
push eax
push dword [esp + 0x20]
call sub.KERNEL32.dll_GetTempFileNameW
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push dword [esp + 0x18]
call fcn.00409b60
lea eax, [0x417070]
push eax
call fcn.0040de60
push dword [0x417070]
call fcn.0040a787
push dword [0x417070]
call fcn.0040a665
push dword [esp + 0x10]
push 0
mov eax, 0x416020
push eax
push dword [0x417070]
call sub.KERNEL32.dll_GetTempFileNameW
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push dword [esp + 0x18]
call fcn.00409b60
lea eax, [0x417024]
push eax
call fcn.0040de60
push dword [0x417024]
call fcn.0040a787
push dword [0x417024]
call fcn.0040a665
push dword [esp + 0x10]
push 0
mov eax, 0x416020
push eax
push dword [0x417024]
call sub.KERNEL32.dll_GetTempFileNameW
push dword [0x417024]
call sub.SHLWAPI.DLL_PathAddBackslashW
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push dword [esp + 0x18]
call fcn.00409b60
lea eax, [0x417038]
push eax
call fcn.0040de60
push dword [0x417038]
call fcn.0040a787
push dword [esp + 0xc]
push dword [0x417038]
call sub.SHLWAPI.DLL_PathRenameExtensionW
push dword [esp + 0x10]
push 0
mov eax, 0x416020
push eax
push dword [0x417024]
call sub.KERNEL32.dll_GetTempFileNameW
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push dword [esp + 0x18]
call fcn.00409b60
lea eax, [0x417068]
push eax
call fcn.0040de60
push dword [esp + 0x10]
call fcn.00409b20
jmp 0x401b6f
push dword [esp + 0x14]
call fcn.0040def0
push dword [esp + 8]
call fcn.0040def0
push dword [esp + 0xc]
call fcn.0040def0
add esp, 0x18
pop ebx
ret
Function at 0x401fa9
Capabilities:
Delete directory

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.0040df60
mov ebx, dword [esp]
cmp ebx, 1
jne 0x401fd4
push dword [0x417010]
call fcn.004053c7
and eax, eax
je 0x401fd4
push dword [0x417010]
call fcn.00405436
push dword [0x417068]
call fcn.0040a787
push dword [0x417058]
call fcn.0040a787
call fcn.004034d1
push dword [0x417038]
call fcn.0040a787
push dword [0x417024]
call sub.KERNEL32.dll_RemoveDirectoryW
push dword [0x417070]
call sub.KERNEL32.dll_RemoveDirectoryW
push dword [esp + 0xc]
jmp 0x4011a5

Function at 0x402022
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402029
call fcn.0040df60
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00405060
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00405060
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00405060
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExW
mov dword [esp + 0x48], eax
push 0x19
call fcn.00405532
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x4020dd
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x4020dd
jmp 0x4020df
jmp 0x4020b0
mov eax, dword [esp + 0x4c]
jmp 0x4020e7
push dword [esp]
call fcn.0040def0
push dword [esp + 4]
call fcn.0040def0
push dword [esp + 8]
call fcn.0040def0
add esp, 0x50
pop ebx
pop ebp
ret 0xc
Function at 0x4024f1
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4024f7
call fcn.0040df60
push dword [esp + 0x2c]
call fcn.004051a0
mov eax, 0x4160d0
mov dword [0x41702c], eax
mov dword [esp], 0
jmp 0x402525
mov eax, 6
cmp eax, dword [esp]
jl 0x402593
mov eax, dword [0x41702c]
movsx eax, byte [eax]
mov dword [esp + 4], eax
inc dword [0x41702c]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
mov ebx, dword [esp + 0xc]
imul ebx, ebx, 0xffffffff
push ebx
call fcn.00405d60
lea eax, [esp + 0xc]
push eax
call fcn.0040de60
mov edx, dword [esp + 0xc]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040dfc0
mov edx, dword [esp + 0xc]
push edx
call fcn.0040dfc0
lea eax, [esp + 0x10]
push eax
call fcn.0040de60
inc dword [esp]
jno 0x402525
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
call sub.KERNEL32.dll_GetCommandLineW
push eax
call fcn.00409b60
lea eax, [esp + 0x14]
push eax
call fcn.0040de60
mov edx, dword [esp + 0x10]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040dfc0
lea eax, [esp + 0x18]
push eax
call fcn.0040de60
mov eax, dword [esp + 0x14]
push eax
call sub.SHLWAPI.DLL_PathRemoveArgsW
mov dword [esp + 0x18], eax
push dword [esp + 0x14]
call fcn.00405d80
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jle 0x402651
push edx
call fcn.0040de20
pop edx
push eax
mov edx, 0x416026
push edx
call fcn.0040dfc0
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040de20
pop edx
push eax
mov ebx, dword [esp + 0x30]
inc ebx
push ebx
push dword [esp + 0x28]
call fcn.004060b0
call fcn.00405182
add dword [esp], edx
call fcn.00406000
pop eax
lea eax, [esp + 0x24]
push eax
call fcn.0040de60
push dword [esp + 0x20]
push dword [esp + 0x10]
call fcn.00409860
mov edx, dword [esp + 0x20]
push edx
call fcn.0040de20
pop edx
push eax
push edx
call fcn.0040dfc0
pop eax
push eax
call fcn.00405170
pop edx
add eax, edx
jmp 0x402686
push dword [esp + 0x14]
call fcn.0040def0
push dword [esp + 8]
call fcn.0040def0
push dword [esp + 0x10]
call fcn.0040def0
push dword [esp + 0xc]
call fcn.0040def0
push dword [esp + 0x20]
call fcn.0040def0
add esp, 0x24
pop ebx
ret

Function at 0x4026b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0040df60
push dword [esp + 0x10]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [esp], eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x417018], eax
push dword [0x417018]
call fcn.00409b40
mov dword [esp + 4], eax
push dword [0x417018]
push dword [esp + 8]
push dword [esp + 8]
call fcn.00409c20
push dword [esp]
call sub.KERNEL32.dll_FreeResource
mov eax, dword [esp + 4]
jmp 0x402715
add esp, 8
ret 8
Function at 0x402bc1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402bc7
call fcn.0040df60
lea eax, [esp]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x402bf3
mov eax, 1
jmp 0x402bf5
xor eax, eax
add esp, 0x24
pop ebp
ret