joyce8/EMBER2024-capa huggingface dataset:
Function at 0x772b1f85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x772b1fde
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x772b1f85
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x772b1f94
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x776b7c37
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x772b1fe5
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77298e5b
cmp eax, dword [ebp + 0xc]
pop eax
je 0x772b2084
add edi, 4
add eax, 2
dec ecx
jne 0x772b1fca
call 0x772b2031
loope 0x772b2027
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x772b2081
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x772b2092
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x772b2045
cmp eax, ecx
ja 0x772b2045
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x772b20cf
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x772b20c5
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7729933a
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x772b1f94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x772b1fde
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x772b1f85
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x772b1f94
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x776b7c37
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x772b1fe5
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77298e5b
cmp eax, dword [ebp + 0xc]
pop eax
je 0x772b2084
add edi, 4
add eax, 2
dec ecx
jne 0x772b1fca
call 0x772b2031
loope 0x772b2027
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x772b2081
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x772b2092
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x772b2045
cmp eax, ecx
ja 0x772b2045
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x772b20cf
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x772b20c5
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7729933a
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40af60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x40b074
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
lea esi, [ecx + 2]
sub ecx, eax
add ecx, 0xfffffffe
lea edx, [eax + 2]
mov dword [esp + 0x18], ecx
lea eax, [edi - 1]
mov dword [esp + 0x10], edx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [esp + 0x20]
call fcn.0040a620
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [esp + 0x18]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [esp + 0x14], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [esp + 0x18]
jne 0x40afa5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413249
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x592de9
call fcn.005663f8
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x413274
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x413331
push 0x612278
lea ecx, [ebp - 0x828]
call fcn.00401650
and dword [ebp - 4], 0
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.0056c410
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x6130e8
push eax
call fcn.004078e0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4132ed
call fcn.0041317a
jmp 0x4132f2
call fcn.00413226
push eax
lea ecx, [ebp - 0x828]
call fcn.00403150
lea ecx, [ebp - 0x840]
call fcn.004015f0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0056f66c
pop ecx
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.004015f0
mov eax, esi
call fcn.005663b3
ret 0xc

Function at 0x41333b
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x592e33
call fcn.005663f8
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
mov dword [ebp - 0x838], esi
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
call fcn.0056c410
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x413398
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00401650
and dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4133de
mov eax, dword [esi]
push ebx
push eax
call fcn.0057802c
pop ecx
pop ecx
test eax, eax
jne 0x413426
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x41340e
call fcn.0041317a
jmp 0x413413
call fcn.00413226
push eax
mov ecx, esi
call fcn.00403150
lea ecx, [ebp - 0x828]
call fcn.004015f0
mov eax, esi
call fcn.005663b3
ret 0x10
Function at 0x413e0f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x61ea64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
mov esi, ecx
call fcn.0056c410
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x413e48
mov eax, dword [eax]
push str.CfgPath
push eax
lea eax, [ebp - 0x20c]
push 0x59782c
push eax
call fcn.004078e0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413e80
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c860
pop ecx
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.0056c410
push str.Use.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x597804
push eax
call fcn.004078e0
lea eax, [ebp - 0x61c]
push eax
call fcn.0057808e
add esp, 0x20
lea ecx, [esi + 0x8c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00401730
push ebx
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.0056c410
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x597804
push eax
call fcn.004078e0
lea eax, [ebp - 0x824]
push eax
call fcn.0057808e
add esp, 0x20
lea ecx, [esi + 0xa4]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.00401730
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056c410
lea eax, [ebp - 0xa44]
push 0x613104
push eax
call fcn.0041d3f2
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x413f47
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x597720
push eax
call fcn.004078e0
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.004015f0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413f85
lea eax, [ebp - 0x414]
push eax
call fcn.0041c860
pop ecx
push ebx
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.0056c410
push str.UseCache.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x597804
push eax
call fcn.004078e0
lea eax, [ebp - 0xa2c]
push eax
call fcn.0057808e
add esp, 0x20
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00401730
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00565c09
leave
ret
Function at 0x41449f
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x592ef8
call fcn.005663f8
mov ebx, ecx
call fcn.0041310c
mov esi, eax
push esi
call fcn.0057808e
pop ecx
push eax
lea edi, [ebx + 0xd4]
push esi
mov ecx, edi
call fcn.00401730
mov esi, str.BKPDFReader.ini
push esi
call fcn.0057808e
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407000
push str.BKpdf
push 0x5978cc
push str.BKApp
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0041333b
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00403150
lea ecx, [ebp - 0x230]
call fcn.004015f0
push str.BKpdf
mov ecx, esi
call fcn.00412ae9
test al, al
je 0x414587
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056c410
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x414546
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.BKpdf
push eax
push edi
push 0x5978cc
push str.BKApp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.0057808e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401730
jmp 0x41458c
mov edi, str.BKpdf
push edi
mov ecx, esi
call fcn.00412ae9
test al, al
je 0x41464c
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056c410
and dword [ebp - 0x220], 0
lea eax, [ebx + 0x5c]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
add esp, 0xc
push eax
call fcn.00403280
and dword [ebp - 4], 0
push str.BKPDFReader.ini
call fcn.0057808e
pop ecx
push eax
push str.BKPDFReader.ini
lea ecx, [ebp - 0x230]
call fcn.00407000
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5978cc
push str.BKApp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.0057808e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401730
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004015f0
push edi
mov ecx, esi
call fcn.00412ae9
test al, al
je 0x414684
push edi
push 0x5978cc
push str.BKApp
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00413203
push eax
mov ecx, esi
call fcn.00403150
lea ecx, [ebp - 0x248]
call fcn.004015f0
call fcn.005663b3
ret
Function at 0x414b65
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592f9e
mov eax, dword fs:[0]
push eax
mov eax, 0x1228
call fcn.005667f0
mov eax, dword [0x61ea64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61fe04], 0
mov esi, dword [ebp + 0xc]
jne 0x414c69
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056c410
lea eax, [ebp - 0x218]
push str.C:LogResLog.dll
push eax
call fcn.0057806c
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414c53
cmp dword [0x61b014], 8
lea ecx, [ebp - 0x1231]
mov eax, section..data
cmovae eax, dword [section..data]
push eax
lea eax, [ebp - 0x1230]
push eax
call fcn.00414ab2
and dword [ebp - 4], 0
mov edi, str.ResLog.dll
push edi
call fcn.0057808e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1230]
call fcn.00407000
cmp dword [ebp - 0x121c], 8
lea eax, [ebp - 0x1230]
cmovae eax, dword [ebp - 0x1230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0057806c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x1230]
call fcn.004015f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x61fe04], eax
test eax, eax
je 0x414cbd
mov edi, 0x612278
push edi
call fcn.0057808e
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00401730
push 0x800
lea eax, [ebp - 0x1218]
push eax
push dword [ebp + 8]
push dword [0x61fe04]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x414cbd
lea eax, [ebp - 0x1218]
push eax
call fcn.0057808e
pop ecx
push eax
lea eax, [ebp - 0x1218]
mov ecx, esi
push eax
call fcn.00401730
mov al, 1
jmp 0x414cbf
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565c09
leave
ret

Function at 0x414cd8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61ea64]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056c410
push 0x613198
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.004078e0
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00565c09
leave
ret
Function at 0x414eec
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.005667f0
mov eax, dword [0x61ea64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2008], eax
call fcn.00414cd8
test eax, eax
je 0x415020
push esi
push edi
xor edi, edi
push edi
call fcn.0056f73f
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
mov dword [ebp - 0x2010], edx
call fcn.00578f7e
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00414a94
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
inc ecx
test eax, eax
push 0x5979a4
push ebx
cmovne edi, ecx
call fcn.00578940
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41501e
test edi, edi
jne 0x414fc1
push esi
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push 1
push eax
call fcn.00578c9c
add esp, 0x10
lea eax, [ebp - 0x2004]
push eax
call fcn.0057808e
push esi
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.00578c9c
push esi
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.00578c9c
push esi
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.00578c9c
push esi
call fcn.005789e4
add esp, 0x38
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00565c09
leave
ret

Function at 0x4151b3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4
Function at 0x415e43
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xb0
mov eax, 0x593200
call fcn.005663f8
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xb8], eax
xor esi, esi
lea ecx, [ebp - 0x28]
push 0x612278
mov dword [ebp - 4], esi
call fcn.00401650
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.00422618
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov edi, esi
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415f0b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
push 0x80
push 4
push esi
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415f0d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xb8]
push eax
mov dword [ecx], eax
call fcn.00565f1a
mov edi, eax
pop ecx
test edi, edi
je 0x415f0d
mov eax, dword [ebp - 0xb8]
push dword [eax]
push esi
push edi
call fcn.0056c410
add esp, 0xc
lea eax, [ebp - 0xbc]
push esi
push eax
mov eax, dword [ebp - 0xb8]
push dword [eax]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
lea ecx, [ebp - 0x28]
call fcn.004015f0
lea ecx, [ebp + 8]
call fcn.004015f0
mov eax, esi
call fcn.005663b3
ret
Function at 0x415f28
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xe4
mov eax, 0x593248
call fcn.005663f8
mov esi, dword [ebp + 8]
mov dword [ebp - 0xe8], esi
mov edi, 0x612278
lea ecx, [ebp - 0x28]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00401650
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 1
call fcn.00422618
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41606b
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x415fb2
push edi
mov ecx, esi
call fcn.00401650
jmp 0x416088
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xec], eax
inc eax
push eax
mov dword [ebp - 0xe8], eax
call fcn.00565f1a
mov edi, eax
pop ecx
test edi, edi
jne 0x415fdc
push 0x612278
jmp 0x415fa6
push dword [ebp - 0xe8]
push 0
push edi
call fcn.0056c410
add esp, 0xc
lea eax, [ebp - 0xf0]
push 0
push eax
push dword [ebp - 0xec]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xec]
lea ecx, [ebp - 0xe4]
push edi
call fcn.00422fd2
push edi
call fcn.00565f15
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xe4]
call fcn.00422823
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004125f8
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.004016a0
cmp dword [ebp - 0x30], 0
jbe 0x416061
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406fd0
lea ecx, [ebp - 0x40]
call fcn.004015f0
xor ebx, ebx
mov byte [ebp - 0xe8], bl
lea eax, [ebp - 0x28]
push dword [ebp - 0xe8]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.004033b0
lea ecx, [ebp - 0x28]
call fcn.004015f0
lea ecx, [ebp + 0xc]
call fcn.004015f0
mov eax, esi
call fcn.005663b3
ret

Function at 0x4160a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 0x80
push 2
push esi
inc edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4160cf
xor eax, eax
jmp 0x4160fd
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4160f9
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x4160fb
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416caa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
je 0x416d55
push ebx
push esi
push edi
xor ebx, ebx
push str.b69749abbfffc7f6494ec5c0eb4c7d2c
mov dword [ebp - 4], ebx
call fcn.00578650
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
call fcn.00565f1a
push edi
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0056b910
add esp, 0x14
mov edx, ebx
test edi, edi
je 0x416d05
mov ecx, ebx
mov al, byte [ecx + str.b69749abbfffc7f6494ec5c0eb4c7d2c]
xor byte [edx + esi], al
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 8]
cmovge ecx, eax
inc edx
cmp edx, edi
jb 0x416cee
cmp edi, 1
jle 0x416d27
cmp byte [esi], 0x37
jne 0x416d27
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x416d1a
cmp al, 0x5a
jne 0x416d27
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.00560070
mov ebx, eax
push esi
call fcn.00565f15
pop ecx
test ebx, ebx
je 0x416d45
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x416d45
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x416d52
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41918b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x593801
call fcn.005663c4
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00423006
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042303a
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4191cb
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41922b
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419206
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41922b
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00423019
call fcn.0056639e
ret 0xc