joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c4550
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10102008
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x1014814b
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ebx
call fcn.100e5245
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100c45a6
mov dword [eax], 0
mov dword [ebx], 0
cmp dword [edi], 0xffffffff
je 0x100c46fb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
nop dword [eax]
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x100c46c6
test eax, eax
je 0x100c46c6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x100c46c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x28], eax
cmp ecx, 0xffffffff
je 0x100c464b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100c463f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100c464b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100c4659
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x28]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.1001af80
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x100c46c6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x100c4604
jmp 0x100c46c9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add dword [ecx], edx
test eax, eax
jne 0x100c46f2
test edx, edx
je 0x100c46ee
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x100c45c0
mov al, 1
jmp 0x100c46fd
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x100c46fb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100c6860
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9ef3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x10144008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, 0x10148135
call fcn.100e5245
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], 4
lea eax, [esi + 0x18]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 8
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
lea eax, [esi + 0x30]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov byte [ebp - 4], 0xd
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xe
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], cl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c8390
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10102b93
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1014814b
mov edi, dword [ebp + 0xc]
call fcn.100e5245
push esi
lea eax, [ebp - 0x38]
push eax
call fcn.100c8a40
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.100cd320
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], 0
test eax, eax
jne 0x100c8426
xor bl, bl
jmp 0x100c8444
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100c843e
cmp eax, 0x80
je 0x100c843e
xor bl, bl
jmp 0x100c8444
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x1c], bl
mov byte [ebp - 4], 4
lea eax, [ebp - 0x39]
push eax
push edi
push esi
mov byte [ebp - 0x39], 0
call fcn.100c84f0
test al, al
jne 0x100c8472
cmp byte [ebp - 0x39], al
je 0x100c8472
cmp dword [esi + 0x14], 8
jb 0x100c846b
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
test bl, bl
je 0x100c848c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c8488
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c84ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x38]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 8
Function at 0x100cb6f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x10144008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
push 0x110
lea eax, [esp + 0xc]
mov dword [esi + 4], 0
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
mov dword [esp + 0x10], 0x114
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x100cb791
cmp dword [esp + 8], 6
jb 0x100cb791
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.100e2b24
add esp, 0x118
ret

Function at 0x100cb7b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101030ae
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x10144008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x1014814b
call fcn.100e5245
push str.wintrust.dll
lea ecx, [ebp - 0x2c]
call fcn.10003030
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.100a6110
mov ecx, eax
call fcn.100a6200
mov ebx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
push str.crypt32.dll
call fcn.10003030
mov dword [ebp - 4], 5
lea eax, [ebp - 0x44]
push eax
call fcn.100a6110
mov ecx, eax
call fcn.100a6200
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100cb8eb
test esi, esi
je 0x100cb8eb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cd320
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10103228
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x1014814b
call fcn.100e5245
mov eax, dword [esi]
test eax, eax
je 0x100cd36d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea ecx, [ebp - 0x14]
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.100bc310
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x100cd396
add eax, 8
jmp 0x100cd398
xor eax, eax
cmp dword [edi + 0x10], 0
je 0x100cd3a8
cmp dword [edi + 0x14], 8
jb 0x100cd3aa
mov edi, dword [edi]
jmp 0x100cd3aa
xor edi, edi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x100cd3cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100cd3cb
mov byte [esi + 5], 1
cmp dword [esi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100bc3f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 4
Function at 0x100cf450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101036d0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10144008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x1014814b
call fcn.100e5245
mov eax, dword [esi]
test eax, eax
je 0x100cf541
cmp byte [eax + 0x54], 0
je 0x100cf541
add eax, 0x1c
lea ecx, [ebp - 0x38]
push eax
call fcn.100c6960
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100a1b20
add esp, 4
mov byte [ebp - 4], 1
lea edi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [esi]
cmovae edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 8
jb 0x100cf4dc
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100cf526
push 2
push 0
push 0
push esi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10003190
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100c69f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100e2b24
mov esp, ebp
pop ebp
ret 4
Function at 0x401a09
Capabilities:
Hide graphical window

Disassembly:
mov ecx, 0xfffffffe
jmp fcn.00401641

Function at 0x1140f000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x1140f00a
jmp 0x1141100f
jmp fcn.11102160

Function at 0x8bf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008bf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8bf07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bf06a
add dl, dl
jne 0x8bf089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bf0dc
xor eax, eax
add dl, dl
jne 0x8bf096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bf17d
add dl, dl
jne 0x8bf0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bf0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bf0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bf0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8bf0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8bf075
mov eax, 1
add dl, dl
jne 0x8bf0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bf0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bf0e1
sub eax, ebx
mov ebx, 1
jne 0x8bf128
mov ecx, 1
add dl, dl
jne 0x8bf10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bf119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bf105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bf075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8bf13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bf14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bf136
cmp eax, 0x7d00
jae 0x8bf16d
cmp eax, 0x500
jb 0x8bf168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bf075
cmp eax, 0x7f
ja 0x8bf170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bf075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8bf19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8bf075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x9f4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9f41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9f407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f406a
add dl, dl
jne 0x9f4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f40dc
xor eax, eax
add dl, dl
jne 0x9f4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f417d
add dl, dl
jne 0x9f40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9f40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9f4075
mov eax, 1
add dl, dl
jne 0x9f40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f40e1
sub eax, ebx
mov ebx, 1
jne 0x9f4128
mov ecx, 1
add dl, dl
jne 0x9f410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9f413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f4136
cmp eax, 0x7d00
jae 0x9f416d
cmp eax, 0x500
jb 0x9f4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f4075
cmp eax, 0x7f
ja 0x9f4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9f419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9f4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401520
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408fb1
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push ebp
push esi
push edi
push 0x443ce0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
xor edi, edi
add esp, 8
cmp ebp, edi
jne 0x40159c
mov esi, dword [esp + 0xb0]
cmp esi, edi
je 0x401595
lea ecx, [esp + 0x10]
push ecx
call fcn.004029f0
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0xa4], edi
call fcn.004086fe
lea ecx, [esp + 0x10]
mov dword [esp + 0xa0], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x401704
mov eax, dword [esp + 0xb4]
cmp eax, edi
je 0x4015af
mov edx, dword [eax]
mov dword [esp + 0x10], edx
jmp 0x4015b3
mov dword [esp + 0x10], edi
xor eax, eax
mov esi, dword [esp + 0xac]
mov dword [esp + 0x21], eax
mov ecx, esi
mov dword [esp + 0x25], eax
mov byte [esp + 0x20], 0
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
call sub.MFC42.DLL_CString::Empty
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push edi
push ebp
call ebx
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebp
mov edi, eax
call ebx
add esp, 0x1c
mov ebx, 1
test edi, edi
je 0x4016b9
push edi
mov ecx, esi
call sub.MFC42.DLL_CString::GetBuffer
push ebp
push ebx
push edi
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, esi
push edi
call sub.MFC42.DLL_CString::ReleaseBuffer
push ecx
mov ecx, dword [esi]
mov eax, esp
mov dword [esp + 0x20], esp
mov dword [eax], ecx
lea ecx, [esp + 0x18]
push ecx
call fcn.00402310
add esp, 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa0], ebx
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x401669
push 5
push str.UTF_8
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x4016a5
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00401720
lea edx, [esp + 0x20]
push edx
call fcn.00402090
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0xa4], 2
call fcn.004086fe
lea ecx, [esp + 0x18]
mov byte [esp + 0xa0], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0xa0], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x20]
push edi
push eax
lea ecx, [esp + 0x3c]
push str._s_d_bytes
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0xc0]
add esp, 0x10
test ecx, ecx
je 0x4016e7
lea edx, [esp + 0x34]
push edx
call fcn.004086f2
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0xb8]
add esp, 4
test eax, eax
je 0x401702
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov al, bl
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x94
ret
Function at 0x401750
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408ff7
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push ebp
push esi
push edi
push 0x443cdc
push eax
mov bl, 1
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
xor edi, edi
add esp, 8
cmp ebp, edi
jne 0x4017ce
mov esi, dword [esp + 0xb0]
cmp esi, edi
je 0x4017c7
lea ecx, [esp + 0x14]
push ecx
call fcn.004029f0
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0xa4], edi
call fcn.004086fe
lea ecx, [esp + 0x14]
mov dword [esp + 0xa0], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x401972
mov eax, dword [esp + 0xb4]
cmp eax, edi
je 0x4017e1
mov edx, dword [eax]
mov dword [esp + 0x14], edx
jmp 0x4017e5
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xac]
xor eax, eax
mov dword [esp + 0x21], eax
mov byte [esp + 0x20], 0
mov ecx, dword [edi]
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
mov esi, dword [ecx - 8]
test esi, esi
je 0x4018e9
push edi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, dword [edi]
mov eax, esp
lea edx, [esp + 0x20]
mov dword [esp + 0x14], esp
push edx
mov dword [esp + 0xa8], 1
mov dword [eax], ecx
call fcn.00402310
add esp, 8
mov eax, dword [esp + 0x1c]
mov bl, 2
mov byte [esp + 0xa0], bl
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40186f
push 5
push str.UTF_8
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x4018a9
mov edi, dword [edi]
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
mov dword [eax], edi
lea eax, [esp + 0x14]
push eax
call fcn.004021c0
add esp, 8
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa4], 3
call fcn.004086fe
lea ecx, [esp + 0x10]
mov byte [esp + 0xa0], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x18]
push ebp
push 1
mov esi, dword [eax - 8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 1
sete bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0xa0], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
push esi
push ecx
lea edx, [esp + 0x3c]
push str._s_d_bytes
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, dword [esp + 0xc0]
add esp, 0x10
test esi, esi
je 0x401919
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.004086f2
test bl, bl
jne 0x401955
test esi, esi
je 0x401955
lea ecx, [esp + 0x10]
push ecx
call fcn.004029f0
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0xa4], 4
call fcn.004086fe
lea ecx, [esp + 0x10]
mov dword [esp + 0xa0], 0xffffffff
call sub.MFC42.DLL_CString::CString
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0xb8]
add esp, 4
test eax, eax
je 0x401970
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov al, bl
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x94
ret
Function at 0x4024f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x409159
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004086f8
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call fcn.004086f8
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov eax, dword [esp + 0x1c]
mov ecx, esi
push eax
mov byte [esp + 0x18], 3
call fcn.00401470
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x405a90
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push esi
push str.COneKeyDLUIApp_GUID8BF25D85_D718_46C9_99ED_A72BAF90F9C4
push 0
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405ade
push 0
push 0x444198
push 0x444180
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
ret