joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a7e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebp, ebp
test eax, eax
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
jbe 0x40a863
push ebx
push edi
mov eax, dword [esi + 0xc]
mov bl, byte [eax + ebp]
mov edi, dword [esi + 0x14]
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edi
mov edi, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov edx, dword [eax + ebx*4]
shr edi, 8
xor edi, edx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x10]
inc ebp
cmp ebp, eax
jb 0x40a804
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x40a870
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push 0xffffffffffffffff
push 0x447988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
mov esi, ecx
push 0xc
lea ecx, [esp + 0x1c]
call fcn.0040bf70
mov eax, dword [esp + 0x18]
push ebp
push 0xc
push eax
lea ecx, [esi + 0x78]
mov dword [esp + 0x34], ebp
call fcn.0040efb0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x18]
mov dl, byte [ecx + ebp]
mov edi, dword [esi + 0x14]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, dl
call fcn.0040f1f0
mov ecx, dword [esi + 0x18]
xor edx, edx
mov dl, bl
xor edx, edi
and edx, 0xff
mov eax, dword [eax + edx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, ecx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
call fcn.0040f1f0
xor ecx, ecx
mov cl, byte [esp + 0x10]
xor ecx, edi
and ecx, 0xff
mov edx, dword [eax + ecx*4]
shr edi, 8
xor edi, edx
inc ebp
cmp ebp, 0xc
mov dword [esi + 0x1c], edi
jl 0x40a8b0
mov ecx, dword [esi + 0x110]
call fcn.0040d970
test al, al
mov esi, dword [esi + 0x110]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
je 0x40a956
mov al, byte [esi + 0x11]
jmp 0x40a959
mov al, byte [esi + 0x17]
cmp al, bl
sete bl
call fcn.0040bfa0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40ac30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4479d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0xe4], 0xff
push edi
mov dword [ebp - 0x10], esp
jne 0x40ad9f
mov al, byte [ebp + 0xc]
xor ebx, ebx
cmp al, bl
mov dword [ebp - 0x14], 1
jne 0x40ad54
cmp dword [esi + 0x60], ebx
jne 0x40ac95
mov eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x40ac9c
push 0xffffffffffffff9a
mov ecx, esi
call fcn.0040a9a0
jmp 0x40ac9c
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [esi + 0x110]
cmp word [eax + 0xe], 8
jne 0x40acb2
lea edx, [esi + 0x28]
push edx
call fcn.0040f410
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x40ad54
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
call fcn.00422898
mov ecx, dword [esi + 0x110]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x248], eax
add esp, 4
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x244], edx
mov byte [ebp - 0x228], bl
call fcn.0040db10
mov ecx, dword [eax]
mov dword [ebp - 0x240], ecx
mov edx, dword [eax + 4]
lea eax, [ebp - 0x248]
push eax
push edi
mov dword [ebp - 0x23c], edx
call fcn.0043adba
mov eax, dword [esi + 0x110]
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40ad54
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [esi + 0xe8]
mov dword [ebp - 4], 0xffffffff
call fcn.0040cae0
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.0040be10
mov ecx, esi
call fcn.0040a620
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b6c0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x447a89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00404200
push 0x44b5d8
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.0040b2b0
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0040b360
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x2c], 1
mov dword [esp + 0x1c], 1
call fcn.004224e9
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x40b74e
mov edx, dword [esp + 8]
push edx
call fcn.0040a3d0
add esp, 4
cmp eax, esi
je 0x40b74e
xor bl, bl
jmp 0x40b750
mov bl, 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b775
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
mov eax, dword [esp + 8]
jne 0x40b80d
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0040b360
mov eax, dword [eax]
push eax
mov byte [esp + 0x28], 2
call fcn.0040b6c0
mov bl, al
mov eax, dword [esp + 0x1c]
add esp, 0xc
neg bl
sbb bl, bl
add eax, 0xfffffff0
inc bl
mov byte [esp + 0x1c], 0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b7c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
mov eax, dword [esp + 8]
jne 0x40b7df
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, dword [esp + 8]
jne 0x40b80d
add eax, 0xfffffff0
mov dword [esp + 0x1c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40b7fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
add eax, 0xfffffff0
mov dword [esp + 0x1c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40b828
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40bda0
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0040bd60
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov eax, dword [esp + 4]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bde1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, bl
pop ebx
pop ecx
ret
Function at 0x40d250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447b58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0040ce50
mov ecx, dword [esi + 0x2c]
push 0
mov dword [esi + 0x30], eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 0x28]
push 0
push 0x16
lea ecx, [esp + 0xc]
call fcn.0040bf70
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esp + 8]
mov edx, dword [ecx]
push 0x16
push eax
mov dword [esp + 0x20], 0
call dword [edx + 0x34]
cmp eax, 0x16
je 0x40d2b8
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040c950
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x10], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x14], ecx
push edi
mov di, word [eax + 0x14]
lea ecx, [esp + 8]
call fcn.0040be10
mov ecx, dword [esi + 0x2c]
xor edx, edx
mov dx, word [esi + 8]
push edx
call fcn.0040e220
mov ecx, dword [esi + 0x2c]
call fcn.0040df80
test eax, eax
jne 0x40d32e
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x30]
add eax, edx
cmp ecx, eax
jae 0x40d32e
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040c950
test di, di
je 0x40d35e
movzx edi, di
push 0
push edi
lea ecx, [esi + 0x18]
call fcn.0040be40
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x1c]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
push edi
push eax
call dword [edx + 0x34]
cmp eax, edi
je 0x40d35e
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040c950
mov ecx, dword [esi + 0x2c]
call fcn.0040df80
test eax, eax
pop edi
je 0x40d36f
xor eax, eax
jmp 0x40d37c
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
sub eax, edx
sub eax, ecx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40d38c
cmp word [esi + 0xe], ax
jne 0x40d397
cmp word [esi + 0xe], 0
jne 0x40d3a0
test eax, eax
je 0x40d3a0
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040c950
movzx eax, word [esi + 0xa]
mov ecx, dword [esi + 0x2c]
push eax
mov byte [esi + 0x3c], 1
call fcn.0040eeb0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40d3bf
mov ecx, esi
call fcn.0040d170
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040bfa0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40d750
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x447cc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.0040bf70
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
push 1
push 0x2e
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.0040efb0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov cx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
mov cx, word [eax + 0x20]
mov dx, word [eax + 0x22]
mov bx, word [eax + 0x1c]
mov bp, word [eax + 0x1e]
mov word [esi + 0x20], dx
mov word [esp + 0x30], cx
mov cx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x14]
mov dword [esi + 0x28], eax
call fcn.0040be10
mov edx, dword [esi + 4]
mov ecx, 0x45c300
cmp edx, dword [ecx]
je 0x40d84c
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040bfa0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
mov ecx, edi
call fcn.0040dfa0
movzx ebx, bx
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], eax
call fcn.0040be40
mov eax, dword [esi + 0x3c]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
push ebx
push eax
call dword [edx + 0x34]
test bp, bp
je 0x40d892
movzx ebx, bp
push 0
push ebx
lea ecx, [esi + 0x2c]
call fcn.0040be40
mov eax, dword [esi + 0x30]
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
push ebx
push eax
call dword [edx + 0x34]
mov eax, dword [esp + 0x30]
test ax, ax
je 0x40d8b6
movzx ebx, ax
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.0040be40
mov esi, dword [esi + 0x48]
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0x34]
mov ecx, edi
call fcn.0040dfa0
cmp eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
sete bl
mov dword [esp + 0x28], 0xffffffff
call fcn.0040bfa0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x40e140
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x447d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx]
push ebx
lea edx, [esp + 8]
push edx
call dword [eax + 0x18]
mov eax, dword [eax]
push eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], 0
call fcn.0040bd60
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ebx, eax
mov eax, dword [esp + 4]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
pop ebx
je 0x40e1fd
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x40f270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40f27f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x45c32c]
test eax, eax
je 0x40f28d
call fcn.0040f210
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x40f38f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x4633bc]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4633bc]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4633bc]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4633bc]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4633bc]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4633bc]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4633bc]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4633bc]
xor eax, ecx
inc esi
dec edi
jne 0x40f2a7
pop edi
test edx, edx
je 0x40f3b1
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4633bc]
xor eax, ecx
inc esi
dec edx
jne 0x40f393
pop ebx
pop esi
not eax
ret 0xc
Function at 0x416e3b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x416e8e
call fcn.00443ad7
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x416e8e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x416e84
xor eax, eax
jmp 0x416fa7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x416ebe
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x416ebe
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x416fa4
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x416eeb
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0040a2a0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x416fa4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x416f34
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x416f34
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x416f2e
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0040a2a0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x416f94
and dword [ebp + 0xc], 0
jmp 0x416f94
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x416f94
push 0xc
call fcn.00436862
mov esi, eax
test esi, esi
pop ecx
je 0x416f76
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x416f78
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x416f8f
push dword [ebp - 8]
call fcn.00432086
jmp 0x416f94
call fcn.0043205d
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x416ef9
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41fd8c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x451468
call fcn.004237b4
mov edi, 0x94
mov eax, edi
call fcn.00421510
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x465a5c], ecx
mov eax, dword [esi + 4]
mov dword [0x465a68], eax
mov edx, dword [esi + 8]
mov dword [0x465a6c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x465a60], esi
cmp ecx, 2
je 0x41fdec
or esi, 0x8000
mov dword [0x465a60], esi
shl eax, 8
add eax, edx
mov dword [0x465a64], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x41fe27
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41fe27
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41fe3f
cmp eax, 0x20b
je 0x41fe2c
mov dword [ebp - 0x1c], esi
jmp 0x41fe53
cmp dword [ecx + 0x84], 0xe
jbe 0x41fe27
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41fe4d
cmp dword [ecx + 0x74], 0xe
jbe 0x41fe27
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00425c4d
pop ecx
test eax, eax
jne 0x41fe67
push 0x1c
call fcn.0041fd68
pop ecx
call fcn.00425b44
test eax, eax
jne 0x41fe78
push 0x10
call fcn.0041fd68
pop ecx
call fcn.0042589c
mov dword [ebp - 4], esi
call fcn.0042569e
test eax, eax
jge 0x41fe91
push 0x1b
call fcn.0041fd43
pop ecx
call fcn.004255ff
mov dword [0x467430], eax
call fcn.00425495
mov dword [0x465a48], eax
call fcn.004253ff
test eax, eax
jge 0x41feb6
push 8
call fcn.0041fd43
pop ecx
call fcn.004251cc
test eax, eax
jge 0x41fec7
push 9
call fcn.0041fd43
pop ecx
push 1
call fcn.0042116e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x41fedd
push eax
call fcn.0041fd43
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00425186
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x41fefe
movzx eax, word [ebp - 0x40]
jmp 0x41ff01
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00431827
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x41ff1f
push edi
call fcn.0042129b
call fcn.004212bd
jmp 0x41ff51
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004237ef
ret

Function at 0x420615
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x420635
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00423a39
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x420658
test byte [esp + 8], 2
je 0x420658
call fcn.00423a27
mov dword [eax], 0xd
call fcn.00423a30
mov dword [eax], 5
jmp 0x420631
xor eax, eax
ret
Function at 0x4211d8
Capabilities:
Terminate process

Disassembly:
push 8
push 0x451510
call fcn.004237b4
push 8
call fcn.004280fd
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x465a9c], esi
jne 0x42120c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x465a98], esi
mov al, byte [ebp + 0x10]
mov byte [0x465a94], al
cmp dword [ebp + 0xc], edi
jne 0x421256
cmp dword [0x467428], edi
je 0x421246
mov eax, dword [0x467424]
sub eax, 4
mov dword [0x467424], eax
cmp eax, dword [0x467428]
jb 0x421246
mov eax, dword [eax]
cmp eax, edi
je 0x421227
call eax
jmp 0x421227
push 0x45c0a4
mov eax, 0x45c09c
call fcn.00421156
pop ecx
push 0x45c0b0
mov eax, 0x45c0a8
call fcn.00421156
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x421287
cmp dword [ebp + 0x10], edi
jne 0x421295
mov dword [0x465a9c], esi
push dword [ebp + 8]
call fcn.00421114
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x421294
push 8
call fcn.00428048
pop ecx
ret
call fcn.004237ef
ret