joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x5de610]
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x40ab0a
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
lea edx, [esp + 0x2c]
push edi
push edx
mov dword [esp + 0x34], 0x4df0c730
mov word [esp + 0x38], 0xdf9d
mov word [esp + 0x3a], 0x4ae3
mov byte [esp + 0x3c], 0x91
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x3e], 0xaa
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x82
mov byte [esp + 0x41], 0xe9
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x5a
mov dword [esp + 0x24], 0x8be2d872
mov word [esp + 0x28], 0x86aa
mov word [esp + 0x2a], 0x4d47
mov byte [esp + 0x2c], 0xb7
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0xcc
mov byte [esp + 0x30], 0xa4
mov byte [esp + 0x31], 0xc
mov byte [esp + 0x32], 0x70
mov byte [esp + 0x33], 0x18
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40abe7
mov eax, dword [esp + 8]
cmp eax, edi
je 0x40abe7
lea edx, [esp + 0xc]
add esi, 0x26c
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
test eax, eax
jne 0x40abdd
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40abdd
mov ecx, dword [eax]
push eax
mov edi, 1
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
add esp, 0x28
ret

Function at 0x40ad50
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x5de610]
sub esp, 0x208
test eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x21c]
mov ebx, ecx
je 0x40adc3
call fcn.0040aaf0
test eax, eax
je 0x40adc3
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x10]
push str.KBrowser
push ecx
lea edx, [ebp - 1]
push 0x4e9918
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
cmp word [esi], 0
jne 0x40ade1
add ebx, 0x26c
dec ebp
push ebx
push 0x4e923c
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 0xc
Function at 0x40b150
Capabilities:
Delete directory

Disassembly:
sub esp, 0x41c
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40b19f
mov ecx, dword [esi + 0x5c]
mov esi, dword [esi + 0x3c]
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x29
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [0x5def58]
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x41c
ret 8
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40b1b5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x42c]
push 0
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push edi
mov ecx, esi
call fcn.0040b050
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00433660
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0048d480
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x18
cmp edi, 0xffffffff
je 0x40b23a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040b050
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x224]
push 0x103
push eax
mov ecx, esi
call fcn.0040afd0
lea ecx, [esp + 0x220]
push ecx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x41c
ret 8

Function at 0x40b290
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x605524]
sub esp, 0x208
test eax, eax
je 0x40b2d4
push 0
push 0x4e99a0
call fcn.0040adf0
mov ecx, dword [esp + 0x20c]
push eax
mov eax, dword [esp + 0x214]
push 0x4e923c
dec eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esp, 0x208
ret 8
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x214]
mov edx, dword [esp + 0x210]
lea eax, [esp + 4]
push 0x4e99a0
push eax
dec ecx
push 0x4e934c
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
add esp, 0x208
ret 8
Function at 0x40b3d3
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push 1
call fcn.004857f0
add esp, 4
mov ecx, esi
call fcn.00409f80
call fcn.004512f0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b451
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
mov dword [esi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x14], eax
call fcn.00453ae0
mov ecx, eax
call fcn.00453b30
call fcn.0047c2a0
mov ecx, eax
call fcn.0047c2f0
push str.Extensions
call fcn.00422f40
mov ecx, eax
call fcn.00424e10
mov ecx, esi
call fcn.0040b360
mov ecx, 0x5df700
call fcn.004a0c20
mov ecx, esi
call fcn.0040b510
pop esi
add esp, 0x14
ret

Function at 0x40b570
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [0x5de610]
sub esp, 0x208
test eax, eax
je 0x40b607
call fcn.0040aaf0
test eax, eax
je 0x40b607
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x40b607
lea ecx, [esp]
push str.KBrowser
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b607
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b607
test al, 0x10
jne 0x40b607
lea ecx, [esp]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x208
ret

Function at 0x40b670
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b69f
push 0
push esi
call fcn.00433030
add esp, 8
test eax, eax
je 0x40b69f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40b69f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x40b990
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x40b9a1
mov edi, str.Main
mov esi, dword [esp + 0x20]
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, 0x503fe0
mov ebx, eax
call fcn.0040abf0
mov ecx, dword [esp + 0x18]
push eax
push esi
push ebx
push 0x503fd0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edx, edx
cmp edx, eax
sbb ebp, ebp
neg ebp
je 0x40ba1f
test esi, esi
je 0x40ba1f
cmp esi, 0x7fffffff
ja 0x40ba1f
mov eax, dword [esp + 0x1c]
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, ebx
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x40ba13
mov cx, word [esi + eax]
test cx, cx
je 0x40ba13
mov word [eax], cx
add eax, 2
dec edx
jne 0x40b9f8
jmp 0x40ba17
test edx, edx
jne 0x40ba1a
sub eax, 2
mov word [eax], 0
push ebx
call fcn.004d0de9
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40ba60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x218]
test ebx, ebx
je 0x40baee
push esi
mov esi, dword [esp + 0x214]
test esi, esi
push edi
jne 0x40ba84
mov esi, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, 0x503fe0
stosw word es:[edi], ax
call fcn.0040abf0
mov ecx, dword [esp + 0x21c]
push eax
lea eax, [esp + 0x10]
push 0x103
push eax
push 0x503fd0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop edi
pop esi
test eax, eax
jbe 0x40baee
cmp word [esp + 4], 0
je 0x40baee
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
mov dword [ebx], eax
mov eax, 1
pop ebx
add esp, 0x208
ret
xor eax, eax
pop ebx
add esp, 0x208
ret
Function at 0x40bc00
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20004
call fcn.004d0e10
push esi
mov esi, dword [esp + 0x2000c]
test esi, esi
jne 0x40bc1b
mov esi, str.Main
mov eax, dword [esp + 0x20020]
mov dword [esp + 4], 1
test eax, eax
je 0x40bdad
mov eax, dword [esp + 0x20024]
test eax, eax
je 0x40bdad
cmp dword [eax], 0
jbe 0x40bdad
mov eax, dword [esp + 0x2001c]
push ebx
push ebp
push edi
mov dword [eax], 1
mov ecx, 0x7fff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x503fe0
xor edi, edi
call fcn.0040abf0
push eax
lea ecx, [esp + 0x18]
push 0x10000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x40bd9e
cmp word [esp + 0x14], di
lea esi, [esp + 0x14]
je 0x40bd9e
mov ebp, dword [esp + 0x2001c]
mov ebx, dword [sym.imp.MSVCRT.dll_wcschr]
push 0x3d
push esi
call ebx
add esp, 8
test eax, eax
je 0x40bccc
cmp edi, ebp
mov word [eax], 0
je 0x40bcf9
mov word [eax], 0x3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
lea esi, [esi + eax*2 + 2]
cmp edi, 0xbb8
jae 0x40bd9e
cmp word [esi], 0
jne 0x40bcb2
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20004
ret
mov edx, dword [esp + 0x20024]
mov edx, dword [edx]
test edx, edx
je 0x40bd47
cmp edx, 0x7fffffff
ja 0x40bd47
mov ecx, dword [esp + 0x20020]
mov ebx, SysReAllocString
sub ebx, edx
mov edi, edx
sub esi, ecx
lea edx, [ebx + edi]
test edx, edx
je 0x40bd3b
mov dx, word [esi + ecx]
test dx, dx
je 0x40bd3b
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x40bd20
jmp 0x40bd3f
test edi, edi
jne 0x40bd42
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x20030]
mov edx, dword [ecx]
shr edx, 1
je 0x40bd96
cmp edx, 0x7fffffff
ja 0x40bd96
mov ecx, dword [esp + 0x2002c]
mov esi, SysReAllocString
sub esi, edx
sub eax, ecx
lea edi, [eax + 2]
lea eax, [esi + edx]
test eax, eax
je 0x40bd8a
mov ax, word [edi + ecx]
test ax, ax
je 0x40bd8a
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40bd6f
jmp 0x40bd8e
test edx, edx
jne 0x40bd91
sub ecx, 2
mov word [ecx], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20004
ret
mov eax, 1
pop esi
add esp, 0x20004
ret

Function at 0x40bdc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x21c
push esi
push edi
mov esi, dword [esp + 0x228]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], 0
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4e923c
lea eax, [esp + 0x24]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
xor ecx, ecx
add esp, 0x10
mov dword [esp + 0xa], ecx
mov word [esp + 8], 0
mov dword [esp + 0xe], ecx
mov dword [esp + 0x12], ecx
mov dword [esp + 0x16], ecx
mov word [esp + 0x1a], cx
mov ecx, 0x503fe0
call fcn.0040abf0
push eax
lea edx, [esp + 0xc]
push 8
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor ecx, ecx
pop edi
cmp ecx, eax
pop esi
sbb eax, eax
neg eax
add esp, 0x21c
ret
Function at 0x40c220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004cf270
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.0041bc00
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x62cd8]
mov dword [esi], 0x4d8bc4
rep stosd dword es:[edi], eax
mov ecx, 0x412
lea edi, [esi + 0x630e8]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x62ee0]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40c71e
Capabilities:
Delete file
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
mov esi, ecx
push edi
push ebx
lea edi, [esi + 0x62ee0]
push 0x103
push edi
push 0x503fd0
push str.KBrowser.exe
push 0x4e9b58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.3.3.0.5
push edi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x40c77d
push ebx
mov ecx, esi
call fcn.0040c8c0
test eax, eax
je 0x40c77d
mov ecx, esi
call fcn.0040c7f0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40c7d5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5e2870]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0xc37a
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0x32
call fcn.0047fee0
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x40c8c0
Capabilities:
Get geographical location
Read .ini file

Disassembly:
sub esp, 0x21c
xor eax, eax
push ebx
mov dword [esp + 6], eax
push esi
mov dword [esp + 0xe], eax
mov esi, ecx
mov dword [esp + 0x12], eax
push edi
mov dword [esp + 0x1a], eax
mov ecx, 0x81
lea edi, [esp + 0x22]
mov word [esp + 0x1e], ax
mov word [esp + 0x20], ax
push 9
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov word [esp + 0x10], 0
push ecx
push 3
push 0x504044
stosw word es:[edi], ax
call fcn.00443a70
add esp, 4
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edx, [esp + 0xc]
push edx
call fcn.0048c050
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push str.url__s
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [esp + 0x23c]
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esi, 0x630e8
push edi
push 0x823
push esi
lea edx, [esp + 0x2c]
push 0x503fd0
push edx
push str.KBrowser.exe
call ebx
cmp word [esi], 0
jne 0x40c990
push edi
push 0x823
push esi
push 0x503fd0
push 0x4e9344
push str.KBrowser.exe
call ebx
xor eax, eax
pop edi
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x21c
ret 4

Function at 0x40cb00
Capabilities:
Delete file
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x40cb24
mov ecx, 0x503fe0
call fcn.004093b0
pop esi
pop ebx
add esp, 0x208
ret
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x62cd8]
push 0x103
push esi
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0040cd90
push esi
call fcn.004338f0
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
lea eax, [esp + 0x10]
push esi
push str._skbrowser.zip
push 0x103
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebx + 0x34]
mov ecx, esi
call fcn.0041c1d0
mov ecx, esi
call fcn.0041c520
mov ecx, esi
call fcn.0041c1f0
lea edx, [esi + 0x5d0d0]
mov ecx, 0x82
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x4e923c
push 0x104
push edx
call ebp
lea edx, [esi + 0x5d4e0]
mov ecx, 0x412
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [ebx + 0x630e8]
push ecx
push 0x4e923c
push 0x824
push edx
call ebp
add esp, 0x10
mov ecx, esi
mov dword [esi + 0x269c], 0x40cdf0
mov dword [esi + 0x2698], ebx
call fcn.0041c120
pop edi
pop ebp
test eax, eax
je 0x40cc64
mov edx, dword [ebx + 0x28]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x28]
push 0
push 0
push 0x402
push 0x3f0
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x28]
push 5
push 0x3f0
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xc36c
call fcn.0047fee0
mov edx, dword [ebx + 0x28]
add esp, 4
push eax
push 0x42e
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x40cd90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [esp + 0x214]
mov eax, dword [esp + 0x210]
lea ecx, [esp + 4]
push ecx
push str._sKBrowser_
push edx
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
add esp, 0x208
ret 8

Function at 0x40ce2c
Capabilities:
Create process on windows
Delete directory
Delete file
Hide graphical window

Disassembly:
mov eax, 0x128c
call fcn.004d0e10
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x28]
push 0x3f0
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esi + 0x62cd8]
lea ebp, [esi + 0x5d104]
push ebx
push ebp
call fcn.004cfdd0
add esp, 8
test eax, eax
je 0x40cfbd
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], 0
rep stosd dword es:[edi], eax
push str.KBrowser.exe
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4e934c
lea ecx, [esp + 0x58]
push 0x103
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x4c]
lea eax, [esp + 0x254]
push edx
push 0x4e962c
push 5
push str._tp:
push str._s_d__s_s
push 0x823
push eax
call edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x30]
add esp, 0x1c
rep stosd dword es:[edi], eax
mov eax, dword [0x5de610]
lea ecx, [esp + 0x254]
test eax, eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x20], 0x504044
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], str.open
je 0x40cf29
mov dword [esp + 0x1c], str.runas
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40cfbd
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc366
mov dword [esi + 0x30], 1
call fcn.0047fee0
mov edx, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
push 0x42e
push edx
call edi
push 0xc368
call fcn.0047fee0
add esp, 4
push eax
mov eax, dword [esi + 0x28]
push 1
push eax
call edi
push 0xc369
call fcn.0047fee0
mov ecx, dword [esi + 0x28]
add esp, 4
push eax
push 2
push ecx
call edi
mov edx, dword [esi + 0x28]
push 1
push 1
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40cfc4
mov ecx, esi
call fcn.0040cfe0
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128c
ret
Function at 0x40cfe0
Capabilities:
Delete directory
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [esi + 0x28]
push 0
push 0x3f0
push eax
mov dword [esi + 0x30], 0
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0xc36a
call fcn.0047fee0
mov ecx, dword [esi + 0x28]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
push 1
push ecx
call ebp
push 0xc367
call fcn.0047fee0
mov edx, dword [esi + 0x28]
add esp, 4
push eax
push 0x42e
push edx
call ebp
mov eax, dword [esi + 0x28]
push 5
push 1
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x28]
push 1
push 1
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
add esi, 0x62cd8
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40dfc0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.360se_iecompat_filter
push ebx
mov esi, ecx
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebp, eax
mov dword [esp + 0x10], ebx
cmp ebp, ebx
jne 0x40e05b
cmp word [esi], bx
je 0x40e0f4
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e0f4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x14
jb 0x40e038
push str.360se_iecompat_filter
push ebx
push 0
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x208], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esi + 0x208]
mov dword [esi + 0x20c], ebx
test ebp, ebp
mov dword [esp + 0x10], 1
je 0x40e0f4
push 0
push 0
push 0
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x40e0e5
push edi
mov ecx, esi
call fcn.0040e5f0
test eax, eax
je 0x40e0de
test ebx, ebx
jne 0x40e098
mov eax, dword [edi + 4]
mov ecx, eax
shl ecx, 5
add ecx, eax
lea ebx, [ecx*8 + 0x14]
cmp ebx, dword [esi + 0x214]
jbe 0x40e0bc
mov ecx, esi
call fcn.0040df90
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esi + 0x210], eax
mov dword [esi + 0x214], ebx
mov eax, dword [esi + 0x210]
test eax, eax
je 0x40e0de
mov ecx, ebx
mov esi, edi
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40e0f4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret