joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564768
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x5cb008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x638], edi
lea eax, [edi + 8]
mov dword [edi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], edi
jb 0x412d0a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], ecx
cmp dword [edi + 0x34], 8
jb 0x412d27
mov eax, dword [edi + 0x20]
jmp 0x412d2a
lea eax, [edi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x412d44
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x412d5e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 3
push ecx
mov dword [edi + 0x68], ecx
mov dword [edi + 0x6c], ecx
call fcn.00433866
push eax
call fcn.00440a79
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004306b0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x412e17
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.004306b0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x412e08
test eax, eax
je 0x412e08
add eax, eax
cmp eax, 0x412
jae 0x412e03
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x412e0e
call fcn.004155c0
lea eax, [ebp - 0x220]
push eax
lea ecx, [edi + 0x20]
call fcn.00407d00
mov eax, dword [edi + 0x30]
test eax, eax
je 0x412e43
cmp dword [edi + 0x34], 8
jb 0x412e29
mov ecx, dword [edi + 0x20]
jmp 0x412e2c
lea ecx, [edi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x412e43
push 1
push 0x5c29b0
lea ecx, [edi + 0x20]
call fcn.0040ab80
cmp dword [edi + 0x30], 0
jne 0x412e58
push 3
push 0x5c35cc
lea ecx, [edi + 0x20]
call fcn.00407d50
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414f82
mov esp, ebp
pop ebp
ret
Function at 0x412e80
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 0
je 0x412e9c
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x412e95
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x412eb3
push eax
call fcn.00414f93
add esp, 4
mov dword [edi + 0x68], 0
mov eax, dword [edi + 0x64]
lea esi, [edi + 0x50]
cmp eax, 8
jb 0x412ec9
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00408470
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x412edf
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x412efa
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00408470
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x412f10
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x412f2b
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00408470
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x412f41
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x412f5b
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00408470
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x412f7a
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x415d20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5649c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5d66b8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5d66b8
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5c29a4
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00417a00
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b10b
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x565111
call fcn.0045329e
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x84]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x41b136
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x41b214
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5c2948
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00407d50
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004306b0
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x569260
push eax
call fcn.0041cbbd
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 1], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x41b1c9
call fcn.0041b027
jmp 0x41b1ce
call fcn.0041b0e1
push eax
lea ecx, [ebp - 0x828]
call fcn.004079b0
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00407c90
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00434865
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00407c90
mov eax, esi
call fcn.00453259
ret 0xc
Function at 0x41b21e
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x56515b
call fcn.0045329e
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004306b0
lea eax, [edi + 0x84]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41b27b
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00407a30
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x41b2c1
mov eax, dword [esi]
jmp 0x41b2c3
mov eax, esi
push ebx
push eax
call fcn.00440d81
pop ecx
pop ecx
test eax, eax
jne 0x41b30f
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x41b2f3
call fcn.0041b027
jmp 0x41b2f8
call fcn.0041b0e1
push eax
mov ecx, esi
call fcn.004079b0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00407c90
mov eax, esi
call fcn.00453259
ret 0x10
Function at 0x41bf29
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x5cb008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.004306b0
lea eax, [edi + 0x24]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41bf62
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5691cc
push eax
call fcn.0041cbbd
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41bf9a
lea eax, [ebp - 0x20c]
push eax
call fcn.004247a5
pop ecx
push str.userconfig.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5691a0
push eax
call fcn.0041cbbd
add esp, 0x10
cmp word [ebp - 0x414], si
jne 0x41bfc7
mov eax, esi
jmp 0x41bfd4
lea eax, [ebp - 0x414]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x84]
call fcn.00407d50
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5691a0
push eax
call fcn.0041cbbd
add esp, 0x10
cmp word [ebp - 0x61c], si
jne 0x41c014
mov eax, esi
jmp 0x41c021
lea eax, [ebp - 0x61c]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0x9c]
call fcn.00407d50
lea eax, [ebp - 0xa44]
push 0x5c29c8
push eax
call fcn.00424ac7
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x41c04f
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5c35d4
push eax
call fcn.0041cbbd
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00407c90
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c090
lea eax, [ebp - 0x824]
push eax
call fcn.004247a5
pop ecx
push str.Config.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5691a0
push eax
call fcn.0041cbbd
add esp, 0x10
cmp word [ebp - 0xa2c], si
je 0x41c0c8
lea eax, [ebp - 0xa2c]
push eax
call fcn.00440de3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xb4]
call fcn.00407d50
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414f82
mov esp, ebp
pop ebp
ret
Function at 0x41c0eb
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x565233
call fcn.0045329e
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.00407a30
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x30], edi
jne 0x41c135
mov ecx, esi
call fcn.0041affb
mov esi, eax
cmp word [esi], di
jne 0x41c124
mov eax, edi
jmp 0x41c12b
push esi
call fcn.00440de3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00407d50
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
jne 0x41c157
mov esi, edi
jmp 0x41c2e8
push str.PandaPdf.exe
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00419a19
add esp, 0xc
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
mov byte [ebp - 4], bl
cmovae eax, dword [ebp - 0x88]
push eax
call esi
test eax, eax
je 0x41c191
mov esi, ebx
jmp 0x41c2db
lea eax, [ebp - 0x70]
push str.8642191540493968534939005349636853706626
push eax
call fcn.0041ea24
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
xor eax, eax
mov byte [ebp - 4], 3
mov esi, 0x5c28ec
mov dword [ebp - 0x14], 7
push esi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.00440de3
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00407d50
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.00407a30
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041a71f
add esp, 0xc
lea ecx, [ebp - 0x58]
push edi
push ebx
call fcn.00407c90
push edi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00407c90
mov esi, dword [ebp - 0x94]
jmp 0x41c2b8
cmp dword [esi + 0x14], 8
jb 0x41c23d
mov eax, dword [esi]
jmp 0x41c23f
mov eax, esi
push eax
lea ecx, [ebp - 0x58]
call fcn.00407a30
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push ebx
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
call fcn.00407a90
sub esp, 0x18
mov byte [ebp - 4], 8
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00407a90
mov byte [ebp - 4], 7
call fcn.0041d6b4
mov eax, dword [ebp - 0x18]
add esp, 0x3c
sub eax, dword [ebp - 0x1c]
cdq
push 0x18
pop ecx
idiv ecx
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x41c2fc
call fcn.00407900
push edi
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00407c90
push 0x18
pop eax
add esi, eax
cmp esi, dword [ebp - 0x90]
jne 0x41c233
mov esi, edi
lea ecx, [ebp - 0x94]
call fcn.00407900
push edi
push ebx
lea ecx, [ebp - 0x70]
call fcn.00407c90
push edi
push ebx
lea ecx, [ebp - 0x88]
call fcn.00407c90
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00407c90
mov eax, esi
call fcn.00453259
ret 4
call fcn.00407900
push edi
push ebx
lea ecx, [ebp - 0x58]
call fcn.00407c90
mov esi, ebx
jmp 0x41c2c6
Function at 0x41c65d
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x565271
call fcn.0045329e
mov ebx, ecx
call fcn.0041affb
lea edi, [ebx + 0xcc]
push eax
mov ecx, edi
call fcn.00407d00
mov esi, str.Config.cfg
push esi
call fcn.00440de3
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040ab80
push str.pdfgf
push 0x569258
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0041b0b7
and dword [ebp - 4], 0
lea esi, [ebx + 0xe4]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x41c6d3
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407e50
push str.pdfgf
mov ecx, esi
call fcn.0041cb87
test eax, eax
jne 0x41c74f
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004306b0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41c700
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.pdfgf
push eax
push edi
push 0x569258
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x41c731
xor eax, eax
jmp 0x41c73e
lea eax, [ebp - 0x218]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407d50
jmp 0x41c754
mov edi, str.pdfgf
push edi
mov ecx, esi
call fcn.0041cb87
test eax, eax
jne 0x41c817
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004306b0
add esp, 0xc
lea eax, [ebx + 0x54]
lea ecx, [ebp - 0x230]
push eax
call fcn.00407a90
push str.Config.cfg
mov byte [ebp - 4], 1
call fcn.00440de3
pop ecx
push eax
push str.Config.cfg
lea ecx, [ebp - 0x230]
call fcn.0040ab80
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x569258
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x41c7e8
xor eax, eax
jmp 0x41c7f5
lea eax, [ebp - 0x218]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00407d50
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00407c90
push edi
mov ecx, esi
call fcn.0041cb87
test eax, eax
jne 0x41c853
push edi
push 0x569258
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0041b21e
push eax
mov ecx, esi
call fcn.004079b0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00407c90
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00407c90
call fcn.00453259
ret
Function at 0x41d95b
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x8c
mov eax, 0x5654ba
call fcn.0045329e
mov ebx, dword [ebp + 0x20]
xor edi, edi
mov dword [ebp - 0x14], 7
push edi
xor eax, eax
mov dword [ebp - 4], edi
push 0x5c2948
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.00407d50
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0042a210
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov esi, edi
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41da26
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push edi
cmovae eax, dword [ebp + 8]
push 0x80
push 4
push edi
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41da22
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebx], eax
call fcn.00414fd9
mov esi, eax
pop ecx
test esi, esi
je 0x41da22
push dword [ebx]
push 0
push esi
call fcn.004306b0
add esp, 0xc
lea eax, [ebp - 0x98]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x41da26
xor edi, edi
mov esi, edi
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00407c90
push edi
push 1
lea ecx, [ebp + 8]
call fcn.00407c90
mov eax, esi
call fcn.00453259
ret
Function at 0x41da44
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xc8
mov eax, 0x565502
call fcn.0045329e
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xd0], ebx
push ebx
xor eax, eax
mov dword [ebp - 4], ebx
push 0x5c2948
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00407d50
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0042a210
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41dbb8
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41dae2
push 0x5c2948
mov ecx, esi
call fcn.00407a30
jmp 0x41dbc3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xcc], eax
call fcn.00414fd9
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41db21
push 0x5c2948
mov ecx, esi
call fcn.00407a30
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00407c90
push ebx
jmp 0x41dbcf
push dword [ebp - 0xcc]
push 0
push ebx
call fcn.004306b0
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
push ebx
call fcn.0042abcb
push ebx
call fcn.00414f93
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc4]
call fcn.0042a419
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.0041a84c
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00407fe0
cmp dword [ebp - 0x30], ebx
jbe 0x41dbad
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407e50
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00407c90
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00408c40
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00407c90
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.00407c90
mov eax, esi
call fcn.00453259
ret

Function at 0x41dbe1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41dc29
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41dc28
cmp edi, dword [ebp - 4]
jne 0x41dc28
mov bl, 1
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ea85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push str.4d10d0313086775e3b6c41fcc5c91113
mov dword [ebp - 4], esi
call fcn.00441340
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, esi
test edi, edi
je 0x41eac0
mov al, byte [esi + str.4d10d0313086775e3b6c41fcc5c91113]
xor byte [ecx + ebx], al
inc esi
xor eax, eax
cmp esi, edx
cmovge esi, eax
inc ecx
cmp ecx, edi
jb 0x41eaaa
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.00401090
test eax, eax
je 0x41eae2
mov edx, dword [ebp - 4]
test edx, edx
je 0x41eae2
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x41eaec
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421068
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x565aba
call fcn.0045326a
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0042abd4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0042ac08
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4210a8
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421108
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4210e3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x421108
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0042abe7
call fcn.00453244
ret 0xc
Function at 0x421590
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x565b55
call fcn.0045329e
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.004306b0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x421687
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x42160c
lea eax, [ebp - 0x218]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00407d50
and dword [ebp - 4], 0
push 0x5c29b0
call fcn.00440de3
pop ecx
push eax
push 0x5c29b0
lea ecx, [ebp - 0x230]
call fcn.0040ab80
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004211f3
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x421678
call fcn.00407c90
mov eax, edi
jmp 0x421739
or dword [ebp - 4], 0xffffffff
call fcn.00407c90
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x421737
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x4216ce
lea eax, [ebp - 0x218]
push eax
call fcn.00440de3
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00407d50
mov esi, 0x5c29b0
mov dword [ebp - 4], 1
push esi
call fcn.00440de3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0040ab80
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004211f3
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.00407c90
test esi, esi
je 0x421737
mov eax, esi
jmp 0x421739
xor eax, eax
call fcn.00453259
ret 4