joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d850
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44affb
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push esi
mov eax, dword [0x45fc58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
test esi, esi
je 0x40d8ea
push 0x3a98
push 0x7530
push 0x2710
push 0x2710
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x40d8e8
lea ecx, [ebp - 0xcc]
call fcn.00406a50
push str._PROXY_DETECT__Failed_to_set_timeouts_for_WinHttp_requests
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004083c0
push eax
call fcn.004038e0
add esp, 8
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], 0xffffffff
call fcn.00406d90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x411730
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x1c], 8
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411779
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
test eax, eax
jne 0x411799
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or edi, esi
cmp dword [ebp + 0x1c], 8
jb 0x41178f
push dword [ebp + 8]
call fcn.00418e43
add esp, 4
mov edx, edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
jmp 0x41177e
Function at 0x413e30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x45fc58]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
xor edi, edi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x413eb9
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x413eb9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c124
add esp, 8
test eax, eax
je 0x413eb3
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x413e80
jmp 0x413eb9
mov edi, dword [ebp - 0x228]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 8
jb 0x413ed1
push dword [ebp + 8]
call fcn.00418e43
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004195d9
mov esp, ebp
pop ebp
ret

Function at 0x414120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x45fc58]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x462250
push dword [0x45f730]
call fcn.0040b9b0
add esp, 8
test eax, eax
jne 0x41417a
push eax
push 0x462250
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x414167
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41417a
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004195d9
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4141be
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0041b5da
lea ecx, [ebp - 0x20c]
sub eax, ecx
sar eax, 1
push eax
push ecx
push 0x104
push 0x462250
call fcn.0041b51c
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004195d9
mov esp, ebp
pop ebp
ret
Function at 0x414cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bac8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x45fc58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x24], 8
push 0x44
lea eax, [ebp - 0x60]
push 0
lea edi, [ebp + 0x10]
cmovae edi, dword [ebp + 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.0041a3f0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
push edi
push ebx
mov dword [ebp - 0x60], 0x44
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x414d79
push 0x19
push str.presenter_app_start_issue
mov ecx, 0x45f73c
call fcn.004026b0
mov dword [0x462234], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x46223c], eax
cmp dword [ebp + 0x24], 8
jb 0x414d8a
push dword [ebp + 0x10]
call fcn.00418e43
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433acc
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45fc58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004214be
mov dword [ebp - 0x14], eax
cmp dword [0x465654], edi
jne 0x433bbd
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x433b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x433c9d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x433c9d
push 0x45490c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433c9d
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x465654], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x465658], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x46565c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465664], eax
test eax, eax
je 0x433bba
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465660], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433be2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433bd5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x433bf7
push 4
pop eax
jmp 0x433c9f
cmp dword [ebp - 0x14], edi
je 0x433bf7
push dword [0x465654]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x433bdc
mov eax, dword [0x465660]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x433c55
cmp dword [0x465664], esi
je 0x433c55
push eax
call ebx
push dword [0x465664]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x433c55
test eax, eax
je 0x433c55
call ecx
test eax, eax
je 0x433c4a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x433c4a
test byte [ebp - 8], 1
jne 0x433c55
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x433c85
mov eax, dword [0x465658]
cmp eax, esi
je 0x433c82
push eax
call ebx
test eax, eax
je 0x433c82
call eax
mov edi, eax
test edi, edi
je 0x433c82
mov eax, dword [0x46565c]
cmp eax, esi
je 0x433c82
push eax
call ebx
test eax, eax
je 0x433c82
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x465654]
call ebx
test eax, eax
je 0x433c9d
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x433c9f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004195d9
leave
ret
Function at 0x4381f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004244c1
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x43822c
xor eax, eax
jmp 0x438258
cmp esi, dword [ebp - 4]
je 0x438255
cmp dword [ebp + 0xc], 0
je 0x438255
push dword [edi + 0x9c]
call fcn.00437e02
push dword [edi + 0x9c]
mov esi, eax
call fcn.004227f2
pop ecx
pop ecx
cmp esi, eax
je 0x438228
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x10dc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010dc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10dc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dc06a
add dl, dl
jne 0x10dc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dc0dc
xor eax, eax
add dl, dl
jne 0x10dc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10dc17d
add dl, dl
jne 0x10dc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10dc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10dc075
mov eax, 1
add dl, dl
jne 0x10dc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10dc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dc0e1
sub eax, ebx
mov ebx, 1
jne 0x10dc128
mov ecx, 1
add dl, dl
jne 0x10dc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10dc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10dc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10dc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10dc136
cmp eax, 0x7d00
jae 0x10dc16d
cmp eax, 0x500
jb 0x10dc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dc075
cmp eax, 0x7f
ja 0x10dc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10dc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10dc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10dc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xa269e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, section.UPX0
push edi
jmp 0xa269fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa26a01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa269f0
mov eax, 1
add ebx, ebx
jne 0xa26a13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa26a24
jne 0xa26a43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa26a43
dec eax
add ebx, ebx
jne 0xa26a30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa26a08
add ebx, ebx
jne 0xa26a3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa26a95
xor ecx, ecx
sub eax, 3
jb 0xa26a5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa26aca
sar eax, 1
mov ebp, eax
jmp 0xa26a66
add ebx, ebx
jne 0xa26a66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa26a34
inc ecx
add ebx, ebx
jne 0xa26a74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa26a34
add ebx, ebx
jne 0xa26a81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa26a76
jne 0xa26a92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa26a76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa26ab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa26aa6
jmp 0xa269f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa26ab4
add edi, ecx
jmp 0xa269f6
pop esi
mov edi, esi
mov ecx, 0x2768
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa26ad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa26ad7
lea edi, [esi + 0x622000]
mov eax, dword [edi]
or eax, eax
je 0xa26b48
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x626c14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x626c50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa26afd
mov ecx, edi
jns 0xa26b2c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x626c58]
or eax, eax
je 0xa26b42
mov dword [ebx], eax
add ebx, 4
jmp 0xa26b1a
call dword [esi + 0x626c54]
mov ebp, dword [esi + 0x626c5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa26b7c
sub esp, 0xffffff80
jmp 0x401394
Function at 0x27504ecd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
sub esp, 0x30
mov dword [esp + 0x28], edx
mov dword [esp], ecx
cmp dword [esp], 0
jne 0x27504ef3
mov dword [esp + 0x10], 0
mov dword [esp + 4], 1
jmp 0x27504fdd
mov eax, dword [esp]
mov ecx, dword [esp]
add eax, dword [ecx + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x24]
add eax, dword [ecx + 0x78]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp eax, dword [ecx + 0x18]
jb 0x27504f3e
mov dword [esp + 4], 2
jmp 0x27504fc6
mov eax, dword [esp]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
add eax, dword [ecx + edx*4]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
call fcn.27504e3d
test al, 1
jne 0x27504f63
jmp 0x27504fa3
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx edx, word [edx + esi*2]
add eax, dword [ecx + edx*4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], 1
jmp 0x27504fab
mov dword [esp + 4], 0
cmp dword [esp + 4], 0
jne 0x27504fc4
jmp 0x27504fb4
mov eax, dword [esp + 8]
add eax, 1
mov dword [esp + 8], eax
jmp 0x27504f24
jmp 0x27504fc6
cmp dword [esp + 4], 2
jne 0x27504fdd
mov dword [esp + 0x10], 0
mov dword [esp + 4], 1
mov eax, dword [esp + 0x10]
add esp, 0x30
pop esi
ret
Function at 0x4037b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x439400
call fcn.004061ff
push 0x439400
call fcn.00405fb8
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403808
sub esp, 0xc
push 0x439400
call fcn.0040631a
sub esp, 0xc
push 0
push 0x439400
call sub.KERNEL32.dll_CreateDirectoryA
push 0x439400
push 0x439000
call fcn.004066dc
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x4066dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x64
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
jmp 0x40671f
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
push esi
push 0
div ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
add ebx, edx
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x40672a
dec edi
cmp edi, 0xffffffff
jne 0x4066ef
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406736
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
push 0x400
push dword [ebp + 8]
push 0x42daa8
call sub.KERNEL32.dll_lstrcpynA
push ebx
push ebx
push 0x42daa8
call fcn.00406196
add esp, 0xc
test eax, eax
mov ebx, eax
je 0x4067f1
sub esp, 0xc
push eax
call fcn.004061ff
add esp, 0xc
cmp byte [0x42f9a8], 0
jns 0x4067b4
mov al, byte [ebx]
test al, al
je 0x4067f1
cmp al, 0x5c
jne 0x4067b4
jmp 0x4067f1
sub esp, 0xc
push 0x42daa8
call fcn.00406137
add esp, 0xc
test eax, eax
je 0x4067a2
test byte [eax], 0x10
je 0x4067f1
sub esp, 0xc
push 0x42daa8
call fcn.004062e5
add esp, 0xc
jmp 0x4067ba
sub ebx, 0x42daa8
sub esp, 0xc
push 0x42daa8
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
cmp eax, ebx
jg 0x406789
sub esp, 0xc
push 0x42daa8
call fcn.0040631a
push 0x42daa8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x4067f3
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4067fa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
pop ecx
cmp eax, 0xffffffff
setne dl
neg edx
push 0
and edx, eax
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406832
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x406858
push edx
and eax, 0xfffffffe
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4068c5
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
push 1
mov ebx, dword [ebp + 0xc]
call fcn.004060e8
add esp, 0xc
test eax, eax
je 0x4068f2
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406ac4
test ebx, ebx
mov dword [0x42cea8], 0x4c554e
je 0x40693b
push ecx
push 1
push 0
push ebx
call fcn.004067fa
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x42cea8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406aca
cmp eax, 0x400
jg 0x406aca
push eax
push 0x400
push 0x42d2a8
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406aca
cmp eax, 0x400
jg 0x406aca
push 0x42d2a8
push 0x42cea8
push str._s_s_r_n
push 0x42d6a8
call sub.USER32.dll_wsprintfA
pop ebx
pop esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x42f948]
push dword [eax + 0x128]
push 0x42d2a8
call fcn.0040640e
sub esp, 0xc
push 4
push 0xc0000000
push 0x42d2a8
call fcn.004067fa
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x406ac4
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
test esi, esi
pop eax
pop edx
je 0x406ab6
sub esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406ab6
cmp ebx, dword [ebp - 0x10]
jne 0x406ab6
push edi
push edi
push str._Rename__r_n
push esi
call fcn.0040685f
pop edx
pop ecx
test eax, eax
jne 0x406a33
push eax
push 0x400
lea eax, [esi + ebx]
add ebx, 0xa
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpynA
mov edx, ebx
pop edi
jmp 0x406a6d
push ecx
add eax, 0xa
push ecx
push 0x40a397
push eax
call fcn.0040685f
pop edi
pop edx
mov edx, ebx
test eax, eax
je 0x406a6d
mov edx, dword [ebp - 0x24]
lea edi, [eax + 1]
lea ecx, [eax + edx]
mov edx, edi
lea eax, [esi + ebx]
mov dword [ebp - 0x28], eax
jmp 0x406a63
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, dword [ebp - 0x28]
jb 0x406a5e
mov edx, edi
sub edx, esi
lea edi, [esi + edx]
mov ecx, dword [ebp - 0x24]
xor edx, edx
jmp 0x406a82
mov al, byte [edx + 0x42d6a8]
dec ecx
mov byte [edi + edx], al
inc edx
test ecx, ecx
jg 0x406a77
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
sub esp, 0xc
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x42f8f8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406dce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x10]
push eax
push 0x42e2a8
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [0x42e2a8], 0x44
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406e16
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406e1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x42e2fc], 0
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push ebx
jne 0x406e5d
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr edx, 1
xor edx, eax
cmp ecx, 8
jne 0x406e37
mov dword [ebx*4 + 0x42e2f8], edx
inc ebx
cmp ebx, 0x100
jne 0x406e33
mov edx, dword [ebp + 8]
not edx
jmp 0x406e77
mov al, byte [edi]
dec esi
inc edi
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x42e2f8]
test esi, esi
jne 0x406e64
not edx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0xadd281
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0xadd2b9
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0xadd2a7
mov al, 1
jmp 0xadd325
cmp dword [ebx + 0x54], ecx
jne 0xadd2b0
mov al, 2
jmp 0xadd325
cmp dword [ebx + 0x7c], ecx
jne 0xadd325
mov al, 3
jmp 0xadd325
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0xadd2ce
mov al, 4
jmp 0xadd325
cmp ecx, 5
jne 0xadd2ee
cmp ebx, 0
jne 0xadd2dc
mov al, 5
jmp 0xadd325
cmp ebx, 1
jne 0xadd2e5
mov al, 6
jmp 0xadd325
cmp ebx, 2
jne 0xadd2ee
mov al, 7
jmp 0xadd325
cmp ecx, 0xa
jne 0xadd2f5
jmp 0xadd323
cmp ecx, 6
jne 0xadd325
cmp ebx, 0
jne 0xadd303
mov al, 8
jmp 0xadd325
cmp ebx, 1
jne 0xadd30c
mov al, 9
jmp 0xadd325
cmp ebx, 2
jne 0xadd315
mov al, 0xa
jmp 0xadd325
cmp ebx, 3
jne 0xadd31e
mov al, 0xb
jmp 0xadd325
cmp ebx, 4
jne 0xadd325
mov al, 0xc
pop ebx
leave
ret