joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2f20
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x5746cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x4a3089
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.004a3360
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x4a2f8f
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x4a2f81
mov eax, dword [0x57da20]
mov esi, dword [eax]
cmp esi, eax
je 0x4a3089
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.004a3360
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x4a30b0
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov word [ebp - 8], ax
cmp ecx, 3
jne 0x4a3041
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
jne 0x4a309c
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4a3067
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4a3063
cmp esi, dword [eax + 8]
jne 0x4a3063
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4a3053
mov esi, eax
jmp 0x4a307d
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4a307d
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4a3071
cmp esi, dword [0x57da20]
jne 0x4a2fb0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004864b8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004864b8
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004864b8
mov esp, ebp
pop ebp
ret

Function at 0x4db393
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004daf98

Function at 0x4db39e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004db119

Function at 0x4e1331
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e0b0b

Function at 0x4e133c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e0d46

Function at 0x4e202c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e1db3
Function at 0x4f1450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004f1a60
add esp, 8
test al, al
je 0x4f1475
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4f1475
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4f1a60
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4f2f10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f2f3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4f2f3b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x6fca60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f9000]
lea eax, [edi + 0x2e524c]
push dword [eax]
mov dword [eax], 0xf065cfb5
push eax
push edi
jmp 0x6fca8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6fca91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fca80
mov eax, 1
add ebx, ebx
jne 0x6fcaa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6fcab4
jne 0x6fcad3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fcad3
dec eax
add ebx, ebx
jne 0x6fcac0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6fca98
add ebx, ebx
jne 0x6fcacf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6fcb25
xor ecx, ecx
sub eax, 3
jb 0x6fcaeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6fcb5a
sar eax, 1
mov ebp, eax
jmp 0x6fcaf6
add ebx, ebx
jne 0x6fcaf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fcac4
inc ecx
add ebx, ebx
jne 0x6fcb04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fcac4
add ebx, ebx
jne 0x6fcb11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6fcb06
jne 0x6fcb22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6fcb06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6fcb44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6fcb36
jmp 0x6fca86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6fcb44
add edi, ecx
jmp 0x6fca86
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xc103
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6fcb66
cmp byte [edi], 0x63
jne 0x6fcb66
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6fcb6b
lea edi, [esi + 0x2f8000]
mov eax, dword [edi]
or eax, eax
je 0x6fcbe3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ff158]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ff344]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6fcb98
mov ecx, edi
jns 0x6fcbc7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ff34c]
or eax, eax
je 0x6fcbdd
mov dword [ebx], eax
add ebx, 4
jmp 0x6fcbb5
call dword [esi + 0x2ff348]
mov ebp, dword [esi + 0x2ff350]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x2af]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6fcc17
sub esp, 0xffffff80
jmp 0x56ad6f
Function at 0x100c0e2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01008580
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100c148
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100e2e4]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x100c14c
xor eax, eax
jmp 0x100c159
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x44d649ad
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1071180
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x404290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x415a84]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404340
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x40433e
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
jmp 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406956
mov esp, ebp
pop ebp
ret
Function at 0x418930
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x418966
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x418a41
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x41898f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x418a41
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4189a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x418a33
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41895b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x418a1e
mov eax, dword [ebp - 8]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x4189e7
mov ecx, 0x2710
cmp eax, ecx
jbe 0x4189e9
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x418a57
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xc], eax
jbe 0x418a14
call edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
jmp 0x418a1e
call edi
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
ja 0x418a50
cmp dword [ebp - 0x1c], 2
je 0x4189cb
or eax, 0xffffffff
mov edi, dword [ebp - 0x1c]
sub edi, 4
neg edi
sbb edi, edi
and edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a50d6
leave
ret
mov eax, 0x41d
jmp 0x418a27
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x418a27

Function at 0x419cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x419d72
cmp byte [esi + 0x3d], 0
je 0x419d72
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x419d44
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x419d48
sub eax, 1
je 0x419d4c
dec eax
sub eax, 1
je 0x419d72
xor al, al
jmp 0x419d74
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x419d69
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004af21b
add esp, 0x10
cmp edi, eax
jne 0x419d44
cmp byte [esi + 0x3d], 0
sete al
jmp 0x419d74
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a50d6
leave
ret
Function at 0x41a834
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x41a857
xor eax, eax
jmp 0x41a91c
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41a883
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41a883
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x41a914
cmp dword [esi + 0x4c], 0
je 0x41a918
mov ecx, esi
call fcn.0041a1ea
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x41a8a3
push dword [esi + 0x4c]
push eax
jmp 0x41a8db
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x41a918
cmp eax, 1
jle 0x41a8eb
cmp eax, 3
jne 0x41a918
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00418b50
pop ecx
pop ecx
test al, al
jne 0x41a914
or ebx, 0xffffffff
jmp 0x41a914
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41a908
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004af21b
add esp, 0x10
cmp edi, eax
jne 0x41a918
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x41a918
mov eax, ebx
jmp 0x41a91b
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a50d6
leave
ret 4
Function at 0x41b131
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x41b153
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b20f
jmp 0x41b20a
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x41b174
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x41b176
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x41b1fe
jg 0x41b189
test esi, esi
je 0x41b1fe
test ecx, ecx
jl 0x41b1cb
jg 0x41b193
test eax, eax
je 0x41b1cb
cmp ebx, ecx
jg 0x41b1a5
jl 0x41b19d
cmp esi, eax
jae 0x41b1a5
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004a82e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x41b1d1
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x41b1fe
jg 0x41b1db
test esi, esi
je 0x41b1fe
cmp dword [edi + 0x4c], 0
je 0x41b1fe
mov ecx, edi
call fcn.0041a1ea
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.004aeb87
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x41b2de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41b300
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b3b2
jmp 0x41b3ad
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x41b321
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x41b323
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x41b3a1
jg 0x41b336
test esi, esi
je 0x41b3a1
test ecx, ecx
jl 0x41b37a
jg 0x41b340
test eax, eax
je 0x41b37a
cmp edi, ecx
jg 0x41b352
jl 0x41b34a
cmp esi, eax
jae 0x41b352
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004a82e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x41b37d
mov edx, dword [ebp + 8]
test edi, edi
jl 0x41b3a1
jg 0x41b387
test esi, esi
je 0x41b3a1
cmp dword [ebx + 0x4c], 0
je 0x41b3a1
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.004af21b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41e803
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41e8ae
push esi
push edi
push 0x105
xor esi, esi
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.004a7f20
mov edi, ebx
add esp, 0xc
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41e840
sub edi, ecx
mov eax, esi
test edi, edi
jle 0x41e8ac
cmp byte [ebx + eax], 0x2f
jne 0x41e859
mov byte [ebx + eax], 0x5c
inc eax
cmp eax, edi
jl 0x41e84f
test edi, edi
jle 0x41e8ac
lea eax, [ebx + esi]
push 0x5c
push eax
call fcn.004a8f20
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41e8a6
sub esi, ebx
lea eax, [ebp - 0x10c]
push esi
push ebx
push eax
call fcn.004a82e0
add esp, 0xc
test esi, esi
jle 0x41e8a3
cmp byte [ebp + esi - 0x10d], 0x3a
je 0x41e8a3
lea eax, [ebp - 0x10c]
push eax
call fcn.004adfd3
pop ecx
inc esi
jmp 0x41e8a8
mov esi, edi
cmp esi, edi
jl 0x41e862
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a50d6
leave
ret

Function at 0x41e92b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0x20]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x10]
or eax, 0x20019
mov dword [edi], esi
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e9c5
push dword [edi]
push esi
push dword [ebp + 0x1c]
call fcn.004a7f20
add esp, 0xc
cmp dword [ebp + 0x14], esi
je 0x41e9ad
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x20]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41e99e
push 0xfffffffffffffffe
pop eax
jmp 0x41e9c8
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
jmp 0x41e9c1
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x1020001
mov dword [edi], esi
xor eax, eax
jmp 0x41e9c8
or eax, 0xffffffff
pop edi
pop esi
leave
ret
Function at 0x41ebfb
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
or esi, 0xffffffff
cmp dword [ebp + 8], 0
je 0x41ed1c
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41ed1b
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x41ed1a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.004ac04c
mov dword [ebp + 8], eax
pop ecx
test eax, eax
je 0x41ed11
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ed08
mov eax, dword [ebp + 8]
push edi
push eax
mov byte [eax + ebx], 0
call fcn.004a9050
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41ed08
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41ec92
sub edi, edx
add ecx, edi
mov al, byte [ecx]
test al, al
je 0x41ecba
mov dl, al
cmp dl, 0x20
je 0x41ecb1
mov al, dl
cmp dl, 9
jne 0x41ecba
inc ecx
mov al, byte [ecx]
mov dl, al
test al, al
jne 0x41eca5
mov edx, ecx
jmp 0x41eccd
cmp al, 0xd
je 0x41ecd3
cmp al, 0xa
je 0x41ecd3
test al, al
je 0x41ecd3
inc ecx
mov al, byte [ecx]
test al, al
jne 0x41ecbe
jmp 0x41ecd6
mov byte [ecx], 0
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ecdb
mov edi, dword [ebp + 0x10]
sub ecx, esi
test edi, edi
je 0x41ed06
mov esi, dword [ebp + 0x14]
dec esi
cmp ecx, esi
jg 0x41ecf5
mov esi, ecx
push esi
push edx
push edi
call fcn.004af750
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x41ed08
mov esi, ecx
push dword [ebp + 8]
call fcn.004ac047
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret