joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41478d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
push esi
xor esi, esi
mov dword [ebp - 0x218], eax
push edi
mov dword [ebx], esi
lea ecx, [ebp - 0x220]
mov dword [eax], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call fcn.0040d96f
mov edi, eax
test edi, edi
jle 0x4147dd
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x414971
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
mov eax, dword [ebp - 0x214]
je 0x414953
test eax, eax
je 0x414953
cmp word [eax], si
je 0x414953
push eax
lea ecx, [ebp - 0x210]
call fcn.00410dca
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x41493d
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push 0
push 0x404f90
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4148c0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x404fd0
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x4148ab
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.004152b1
mov esi, dword [ebp - 0x210]
mov edi, eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 0
je 0x4148e5
push 0x404fe8
lea ecx, [ebp - 0x210]
call fcn.004152b1
push 1
push 0x212
mov edi, eax
call dword [sym.imp.urlmon.dll_Ordinal_414]
mov esi, dword [ebp - 0x210]
test edi, edi
js 0x414942
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x218]
add eax, eax
push eax
mov dword [ecx], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x41493d
mov ecx, dword [ebp - 0x218]
push dword [ecx]
push esi
push dword [ecx]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
je 0x414942
push dword [ebx]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [ebx], 0
mov edi, 0x80004005
pop ecx
mov ecx, dword [ebp - 0x218]
and dword [ecx], 0
jmp 0x414942
mov edi, 0x8007000e
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x214]
xor esi, esi
jmp 0x414958
mov edi, 0x80004005
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x220]
mov dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret
Function at 0x415606
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ecx], 0
push esi
mov esi, 0x80004005
je 0x4156b3
cmp dword [ebp + 8], 0
je 0x4156b3
cmp dword [ebp + 0x10], 0
je 0x4156b3
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x800c
push dword [ecx]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41569e
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41567e
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x415693
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x415693
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x4156b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4156b3
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4156c1
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0x80004005
mov dword [ebp - 0xc], ebx
cmp dword [edi], ebx
je 0x4157d2
cmp dword [ebp + 8], ebx
je 0x4157d2
cmp dword [ebp + 0x10], ebx
je 0x4157d2
cmp dword [ebp + 0x18], ebx
je 0x4157d2
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x800c
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4157b9
push ebx
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x415799
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00415b8c
test eax, eax
js 0x415785
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x415765
mov esi, dword [ebp - 0xc]
jmp 0x41577a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41577a
movzx esi, si
or esi, 0x80070000
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x4157ae
push 1
push 0x1e1
mov esi, 0x80092004
call dword [sym.imp.urlmon.dll_Ordinal_414]
jmp 0x4157ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4157ae
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x4157ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4157d0
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4157df
push 1
push 0x20e
call dword [sym.imp.urlmon.dll_Ordinal_414]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4162eb
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], eax
push ebx
push esi
push edi
mov edi, 0x80070057
test eax, eax
je 0x416423
xor ebx, ebx
mov edi, 0x80004005
mov byte [eax], bl
mov eax, dword [ecx]
push 0x20
pop esi
cmp dword [eax], ebx
je 0x416355
lea ecx, [ebp - 0x24]
push ecx
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x41633d
mov edi, ebx
jmp 0x416352
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x416352
movzx edi, di
or edi, 0x80070000
mov ecx, dword [ebp - 0x2c]
test edi, edi
js 0x416423
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x40], ebx
push eax
push ecx
push 0x406398
push 1
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x3c], ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
call fcn.00416f3a
mov esi, dword [ebp - 0x34]
mov edi, eax
test edi, edi
js 0x41641c
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
test esi, esi
je 0x4163ee
mov ecx, dword [ebp - 0x2c]
push esi
mov ecx, dword [ecx]
call fcn.00415a65
mov edi, eax
mov eax, dword [ebp - 0x28]
test edi, edi
js 0x4163f3
cmp eax, 1
jne 0x4163ee
test ebx, ebx
je 0x4163ee
push dword [ebx]
lea eax, [ebp - 0x24]
push dword [ebx + 4]
push dword [ebx + 8]
push dword [ebx + 0xc]
push ecx
push eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call fcn.004156c1
mov ecx, dword [ebp - 0x38]
test eax, eax
setns al
mov byte [ecx], al
mov eax, dword [ebp - 0x28]
jmp 0x4163f3
mov edi, 0x80004005
test ebx, ebx
je 0x41641c
test eax, eax
je 0x416414
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.00412957
add ebx, 0x10
dec esi
jne 0x416401
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret 8
Function at 0x416ac2
Capabilities:
Connect to http server
Create http request
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x22dc
call fcn.00423c10
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0x22a0], ecx
lea ecx, [ebp - 0x2298]
push ebx
push ecx
lea ecx, [ebp - 0x124c]
mov dword [ebp - 0x2298], 0x824
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x416c62
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x22dc]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x204]
mov dword [ebp - 0x22dc], edi
mov dword [ebp - 0x22cc], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x22c8], 0x100
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x2294]
mov dword [ebp - 0x22b0], eax
xor eax, eax
mov word [ebp - 0x2294], ax
lea eax, [ebp - 0x22dc]
push eax
push ebx
push dword [ebp - 0x2298]
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x22ac], 0x824
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x416c62
push ebx
push ebx
push ebx
push ebx
push 0x40623c
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x416c62
push ebx
push 0x200
push 3
push ebx
push ebx
push dword [ebp - 0x22c4]
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x416c44
cmp dword [ebp - 0x22d0], 4
mov eax, 0x680100
jne 0x416be2
mov eax, 0xe80100
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2294]
push eax
push 0x40624c
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x229c], eax
test eax, eax
je 0x416c26
push dword [ebp - 0x22a0]
push dword [ebp + 0x10]
push esi
push eax
call fcn.00416c91
push dword [ebp - 0x229c]
mov esi, eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416c3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416c3b
movzx esi, si
or esi, 0x80070000
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416c59
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x416c77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416c77
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419867
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
test edi, edi
je 0x419992
test edx, edx
je 0x419992
mov eax, dword [ebp + 8]
test eax, eax
je 0x419992
push ebx
push esi
xor esi, esi
push 0x2000
mov dword [edx], esi
push edi
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_strnlen]
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], ebx
lea eax, [ebx - 1]
cmp eax, 0x1ffe
ja 0x419987
mov eax, esi
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4198f1
mov al, byte [eax + edi]
mov byte [ebp - 1], al
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll_isalnum]
pop ecx
test eax, eax
jne 0x4198e6
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x4198e6
cmp al, 0x2f
je 0x4198e6
cmp al, 0x3d
jne 0x419953
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, ebx
jb 0x4198c2
push esi
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
push 1
push ebx
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x419970
mov eax, dword [ebp - 8]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x419969
push esi
push esi
lea eax, [ebp - 8]
push eax
push ebx
push 1
push dword [ebp - 0xc]
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x41995a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419949
movzx esi, si
or esi, 0x80070000
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x41998c
mov esi, 0x8007000d
jmp 0x41998c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x41998c
mov esi, 0x8007000e
jmp 0x41998c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41998c
movzx esi, si
or esi, 0x80070000
jmp 0x41998c
mov esi, 0x80070057
mov eax, esi
pop esi
pop ebx
jmp 0x419997
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x419a4e
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
mov ebx, edx
test edi, edi
je 0x419afd
test ebx, ebx
je 0x419afd
push esi
xor edx, edx
lea ecx, [ebp - 4]
push ecx
push edx
push 0x40000001
push ebx
push eax
mov esi, edx
mov dword [edi], edx
mov dword [ebp - 4], edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x419ae3
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [edi], eax
pop ecx
test eax, eax
je 0x419adc
lea ecx, [ebp - 4]
push ecx
push eax
push 0x40000001
push ebx
push dword [ebp - 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x419af8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419ace
movzx esi, si
or esi, 0x80070000
push dword [edi]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [edi], 0
pop ecx
jmp 0x419af8
mov esi, 0x8007000e
jmp 0x419af8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419af8
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
jmp 0x419b02
mov eax, 0x80070057
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419b81
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, edx
push ebx
push esi
mov dword [ebp - 8], eax
xor ebx, ebx
lea esi, [eax + 4]
mov eax, dword [ebp + 0xc]
push edi
push esi
mov edi, ecx
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], esi
test esi, esi
je 0x419c2b
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll_rand_s]
pop ecx
test eax, eax
jne 0x419c24
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi], ecx
add esi, 4
shr edx, 2
test edx, edx
je 0x419bf9
imul ecx, ecx, 0x343fd
mov dword [ebp - 0xc], ebx
add ecx, 0x269ec3
mov dword [ebp - 4], ecx
mov al, byte [ebp + ebx - 4]
xor al, byte [edi]
inc ebx
inc edi
mov byte [esi], al
inc esi
cmp ebx, 4
jb 0x419be3
push 0
pop ebx
dec edx
jne 0x419bd1
mov edx, dword [ebp - 8]
imul eax, ecx, 0x343fd
mov ecx, ebx
add eax, 0x269ec3
mov dword [ebp - 4], eax
and edx, 3
jbe 0x419c30
sub esi, edi
mov al, byte [ebp + ecx - 4]
xor al, byte [edi]
inc ecx
mov byte [esi + edi], al
inc edi
cmp ecx, edx
jb 0x419c13
jmp 0x419c30
mov ebx, 0x80004005
jmp 0x419c30
mov ebx, 0x8007000e
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419c40
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov dword [ebp - 8], ecx
push dword [ebx]
xor edi, edi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [esi], eax
pop ecx
test eax, eax
je 0x419cdb
push dword [ebx]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
mov esi, dword [esi]
mov ebx, dword [eax]
lea ecx, [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr eax, 2
mov dword [ebp - 8], eax
test eax, eax
je 0x419cae
imul ebx, ebx, 0x343fd
mov edx, edi
add ebx, 0x269ec3
mov dword [ebp - 4], ebx
mov al, byte [ebp + edx - 4]
xor al, byte [ecx]
inc ecx
mov byte [esi], al
inc esi
inc edx
cmp edx, 4
jb 0x419c99
dec dword [ebp - 8]
jne 0x419c88
imul eax, ebx, 0x343fd
mov edx, edi
add eax, 0x269ec3
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
and ebx, 3
jbe 0x419ce0
sub esi, ecx
mov al, byte [ebp + edx - 4]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
inc edx
cmp edx, ebx
jb 0x419cca
jmp 0x419ce0
mov edi, 0x8007000e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c8db
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xac], eax
mov dword [eax], ebx
lea eax, [ebp - 0xa0]
push ecx
push eax
mov dword [ebp - 0xa4], edx
lea edx, [ebp - 0x88]
push 0x81
mov byte [ebp - 0x88], bl
mov dword [ebp - 0xa0], ebx
call fcn.0041eebc
mov esi, eax
test esi, esi
js 0x41cb01
push edi
push 0x448
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x41c953
push ecx
mov ecx, eax
call fcn.0041c6f6
mov edi, eax
jmp 0x41c955
mov edi, ebx
test edi, edi
jne 0x41c96d
mov esi, 0x8007000e
mov dword [0x42484c], 0x1a8
jmp 0x41cb00
lea ebx, [edi + 0x410]
mov edx, ebx
call fcn.0041cdf2
mov esi, eax
test esi, esi
js 0x41cb00
push 0x3e8
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41c9a0
mov ecx, eax
call fcn.0041cf28
mov esi, eax
jmp 0x41c9a2
xor esi, esi
test esi, esi
js 0x41caf1
lea eax, [ebp - 0x99]
mov byte [ebp - 0x99], 1
push eax
push 0
push dword [ebp - 0xa4]
mov ecx, edi
call fcn.0041ccbe
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41cab0
cmp byte [ebp - 0x99], 0
jne 0x41ca27
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x41ca0c
call fcn.0041e894
jmp 0x41ca0e
xor eax, eax
test eax, eax
js 0x41ca27
lea eax, [ebp - 0xa8]
push eax
push eax
push eax
push dword [edi + 0x418]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0x3e8
push dword [edi + 0x414]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41ca47
mov ecx, eax
call fcn.0041cf28
mov esi, eax
jmp 0x41ca49
xor esi, esi
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41cab0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x41ca63
xor esi, esi
jmp 0x41ca6a
call fcn.0041cf8a
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
js 0x41ca8c
push ecx
push ecx
lea eax, [ebp - 0x88]
mov ecx, edi
push eax
call fcn.0041d537
mov esi, eax
mov dword [ebp - 0xa0], esi
push dword [edi + 0x414]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41cae1
call fcn.0041cf8a
test eax, eax
jns 0x41cae1
test esi, esi
js 0x41caf1
push 0x1d7
jmp 0x41cace
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41cae1
call fcn.0041cf8a
test eax, eax
jns 0x41cae1
test esi, esi
js 0x41caf1
push 0x1dd
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.0041c6c5
mov esi, dword [ebp - 0xa0]
test esi, esi
js 0x41caf1
mov eax, dword [ebp - 0xac]
xor esi, esi
mov dword [eax], edi
jmp 0x41cb00
mov ecx, edi
call fcn.0041c750
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41d88d
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x18
push 0x423d08
call fcn.00423a88
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x80004005
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x418]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41d8c3
push 0x65d
jmp 0x41da48
cmp dword [ebp - 0x24], 0
jle 0x41d8dd
mov esi, 0x80070570
mov dword [0x424850], 0x663
jmp 0x41da5a
cmp dword [ebp - 0x28], 0x600000
jbe 0x41d8fa
mov esi, 0x80070570
mov dword [0x424850], 0x667
jmp 0x41da5a
and dword [ebp - 0x1c], 0
lea edx, [ebp - 0x1c]
mov ecx, dword [edi + 0x418]
call fcn.0041d804
mov esi, eax
test esi, esi
js 0x41d934
mov eax, dword [ebp - 0x1c]
and eax, 0xffff0000
cmp eax, 0x4020000
je 0x41d932
mov esi, 0xc00ee064
mov dword [0x42484c], 0x64c
jmp 0x41d934
xor esi, esi
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x41da5a
mov ebx, dword [ebp - 0x28]
lea eax, [edi + 0x208]
push eax
push ebx
push 0
push 4
push 0
push dword [edi + 0x418]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x41c], eax
test eax, eax
jne 0x41d970
push 0x678
jmp 0x41da48
mov ecx, eax
call fcn.0041cfb7
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x41da5a
push ebx
xor ebx, ebx
push ebx
push ebx
push 6
push dword [edi + 0x41c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [edi + 0x420], edx
test edx, edx
je 0x41da43
mov dword [ebp - 4], ebx
mov eax, dword [edx + 0x5c]
mov dword [edi + 0x424], eax
mov eax, dword [edx + 8]
mov dword [edi + 0x428], eax
mov eax, dword [edx + 0xc]
mov dword [edi + 0x42c], eax
mov eax, dword [edx + 0x24]
mov dword [edi + 0x430], eax
mov edx, dword [edx + 0x28]
mov dword [edi + 0x434], edx
lea eax, [edi + 0x438]
push eax
mov ecx, dword [edi + 0x430]
call fcn.0040d3ef
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x41da00
push 3
mov ecx, edi
call fcn.0041e550
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x41da32
cmp esi, 0x80070570
jne 0x41da5a
mov ecx, edi
call fcn.0041f1af
jmp 0x41da5a
push 0x69f
call fcn.0040f825
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.0041c6c5
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.00423acd
ret