joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d3e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 0x690], eax
call fcn.00402d81
test eax, eax
jne 0x403328
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004016b1
leave
ret 4
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x402d6d
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x402d6d
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4034c9
push 0x4035f0
push esi
lea eax, [ebp - 0x28c]
push eax
call fcn.00407287
test eax, eax
jl 0x4034c9
push edi
push edi
push 3
push edi
push 1
push 0x80
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x694], eax
cmp eax, 0xffffffff
je 0x4034c9
lea ecx, [ebp - 0x6a8]
push ecx
push edi
lea ecx, [ebp - 0x6a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4034bd
mov eax, 0x1c81080
cmp dword [ebp - 0x69c], eax
jb 0x4033d7
cmp dword [ebp - 0x6a4], eax
jae 0x4034bd
mov eax, dword [0x40c5e0]
cmp eax, edi
jne 0x4033e5
call fcn.00406d7c
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x200
lea ecx, [ebp - 0x68c]
push ecx
push 0x2c3
push eax
call esi
test eax, eax
je 0x4034bd
mov eax, dword [0x40c5e0]
cmp eax, edi
jne 0x403415
call fcn.00406d7c
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x2d3
push eax
call esi
test eax, eax
je 0x4034bd
push 0x31
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x68c]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4034bd
push ebx
lea eax, [ebp - 0x698]
push eax
call fcn.00407209
test eax, eax
jne 0x403471
cmp dword [ebp - 0x698], edi
je 0x40346a
mov ebx, 0x403590
jmp 0x403476
mov ebx, 0x403530
jmp 0x403476
mov ebx, 0x4034d0
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x40347b
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x4034bc
mov eax, dword [ebp - 0x690]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x690]
push ebx
push esi
push edi
mov dword [eax], edi
call fcn.004020e3
pop ebx
push dword [ebp - 0x694]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x402d6d
Function at 0x40929b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x406bf4
push 0x406ba0
push 0x80000001
mov dword [ebp - 8], 4
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0x4092ee
cmp dword [ebp - 0xc], 4
jne 0x4092ea
cmp dword [ebp - 4], 1
je 0x4092ee
cmp dword [ebp - 4], 2
je 0x4092ee
cmp dword [ebp - 4], 0xa
je 0x4092ee
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x409312
call fcn.00409217
mov dword [ebp - 4], eax
test eax, eax
je 0x409312
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x409312
push dword [ebp - 4]
call fcn.00409120
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40934a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4093e7
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push edi
push 4
pop edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
push ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x4093a5
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0x4093d3
cmp eax, ebx
je 0x4093d3
cmp eax, 1
je 0x4093d3
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x10
push 0x406c14
push ebx
push dword [ebp - 8]
mov dword [ebp + 0xc], edi
call esi
test eax, eax
jne 0x4093dc
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
je 0x4093d3
cmp eax, ebx
je 0x4093d3
cmp eax, 1
jne 0x4093dc
mov ecx, dword [ebp + 0x18]
mov byte [ebp - 1], 1
mov dword [ecx], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret 0x14
Function at 0xaa4a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x591000]
push edi
or ebp, 0xffffffff
jmp 0xaa4a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xaa4a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaa4a38
mov eax, 1
add ebx, ebx
jne 0xaa4a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xaa4a6c
jne 0xaa4a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaa4a8b
dec eax
add ebx, ebx
jne 0xaa4a78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xaa4a50
add ebx, ebx
jne 0xaa4a87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xaa4add
xor ecx, ecx
sub eax, 3
jb 0xaa4aa3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xaa4b12
sar eax, 1
mov ebp, eax
jmp 0xaa4aae
add ebx, ebx
jne 0xaa4aae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaa4a7c
inc ecx
add ebx, ebx
jne 0xaa4abc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaa4a7c
add ebx, ebx
jne 0xaa4ac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xaa4abe
jne 0xaa4ada
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xaa4abe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xaa4afc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xaa4aee
jmp 0xaa4a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xaa4afc
add edi, ecx
jmp 0xaa4a3e
pop esi
mov edi, esi
mov ecx, 0x6791c6
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xaa4b37
cmp byte [edi], 0xc3
jne 0xaa4b1c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xaa4b1a
lea edi, [esi + 0x6a2000]
mov eax, dword [edi]
or eax, eax
je 0xaa4b88
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6a67dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6a6818]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xaa4b3d
mov ecx, edi
jns 0xaa4b6c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6a681c]
or eax, eax
je 0xaa4b82
mov dword [ebx], eax
add ebx, 4
jmp 0xaa4b5a
call dword [esi + 0x6a682c]
mov ebp, dword [esi + 0x6a6820]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xaa4bbc
sub esp, 0xffffff80
jmp 0x425ed8
Function at 0x4e3c4a
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [edx + 0x1c]
call fcn.005171b4
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x4e3cbf
inc ebx
jb 0x4e3cc6
je 0x4e3cc8
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add al, al
shr dl, 2
mov dl, 0x80
or al, 0x57
invalid
pop ds
aad 8
or dl, bh
fsetpm
insd dword es:[edi], dx
in al, 0x6d
loop 0x4e3ced
mov dh, 0x34
or edi, dword [eax + 0x6399efa3]
and esp, ebx
in eax, dx
xor cl, byte [edi + 0x3f4f3f65]
out 0xbe, al
rcl byte [ecx], cl
iretd
scasd eax, dword es:[edi]
cmp cl, byte [edx - 0x2b]
push ss
cli
fdiv qword [esi]
in eax, dx
xor dword [ebp - 0x27], ecx
mov ebx, 0x1ed5c1c3
jns 0x4e3cf5
adc ebx, ebp
push 0xffffffffffffffc6
adc al, 0xac
sub eax, eax
mov dl, 0x31
insb byte es:[edi], dx
xchg dword [edx], ebx
add al, 0x9e
ljmp 0x69f0:0x9ed88aa5
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x8ccbcf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8cc92e
inc esi
and esi, ebx
inc ebx
call fcn.008ccc18
mov esi, 0x4ac805c7
push 0x8363f500
pop esi
xor dword [edi], eax
add esi, 0x43d8a1bf
mov esi, esi
add ebx, ebx
add edi, 1
or esi, esi
and esi, ebx
sub ebx, esi
cmp edi, ecx
jne fcn.008ccbcf
sub ebx, 0xcfeb331b
mov ebx, 0x4ee7e8f
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408b98
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408a54
xor esi, esi
pop ecx
cmp dword [0x425628], esi
jle 0x401046
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408a54
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401027
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00403870
call fcn.00403864
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004038e6
pop ecx
pop ecx
mov esi, eax
call fcn.0040386a
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x424010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42400c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x425420]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41c24c
push 0x41c23c
push dword [0x425424]
push 1
push eax
push 1
push esi
push edi
call fcn.0040339c
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x403d65
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403e08
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.004063f4
pop ecx
pop ecx
test eax, eax
je 0x403df1
test ebx, ebx
je 0x403de5
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004062bb
pop ecx
pop ecx
test eax, eax
jle 0x403df1
push ebx
call fcn.0040394e
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040392d
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403db2
xor edi, edi
cmp ebx, edi
jne 0x403e0c
xor eax, eax
jmp 0x403e78
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403e3b
call fcn.0040394e
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403e08
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403e08
call fcn.0040394e
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403e2b
cmp dword [ebp - 0x70], edi
je 0x403e6e
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040392d
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004096b8
add ebp, 0x9c
leave
ret
Function at 0x404f51
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x10000
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
push edi
call fcn.0040af2a
add esp, 0x18
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x404f9a
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0xc]
push edi
call fcn.0040af2a
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [0x424040], edi
je 0x405033
push str.J2D_D3D
call fcn.00408b98
pop ecx
mov esi, str.false
cmp eax, edi
je 0x404fcd
push esi
push eax
call fcn.0041b329
pop ecx
pop ecx
test eax, eax
jne 0x404fcd
mov dword [0x424040], edi
push ebx
push str.J2D_D3D_PRELOAD
call fcn.00408b98
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x404ff2
push esi
push ebx
call fcn.0041b329
pop ecx
pop ecx
test eax, eax
jne 0x404ff2
mov dword [0x424040], edi
cmp dword [0x424040], edi
jge 0x405025
mov dword [0x424040], edi
cmp ebx, edi
je 0x405032
push str.true
push ebx
call fcn.0041b329
pop ecx
pop ecx
test eax, eax
jne 0x40501f
mov dword [0x424040], 1
cmp dword [0x424040], edi
je 0x405032
push str.preloadD3D
call fcn.00404e1c
pop ecx
pop ebx
mov esi, dword [ebp - 8]
cmp esi, edi
je 0x405057
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405060
push dword [ebp + 0x14]
call dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x4254a0], edi
pop edi
pop esi
je 0x40506f
call fcn.00404454
mov eax, dword [ebp - 4]
leave
ret
Function at 0x405207
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x10
pop edi
call fcn.00405074
push 8
mov esi, eax
call fcn.004038e6
mov dword [esp], 0x4254c0
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40524e
push ebx
call fcn.0040394e
pop ecx
call fcn.00405098
xor eax, eax
jmp 0x405348
mov dword [ebx], eax
mov dword [ebx + 4], 0x4254ec
mov edi, dword [ebx + 4]
test edi, edi
je 0x405264
and dword [ebx + 4], 0
jmp 0x40527d
push 0x4254c0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x4254ec
test edi, edi
je 0x40532e
push edi
call fcn.00409030
pop ecx
cmp eax, 4
jl 0x405257
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x405257
add eax, 0xfffffffd
push 0x41d9dc
push eax
mov dword [ebp - 4], eax
call fcn.004096d0
pop ecx
pop ecx
test eax, eax
je 0x4052c3
push 0x41d9d8
push dword [ebp - 4]
call fcn.004096d0
pop ecx
pop ecx
test eax, eax
jne 0x405257
push 0x3b
push edi
call fcn.0040ad10
pop ecx
pop ecx
test eax, eax
jne 0x405257
push dword [ebp + 8]
call fcn.00409030
push edi
mov ebx, eax
call fcn.00409030
mov dword [ebp - 4], eax
add eax, ebx
push eax
call fcn.004038e6
lea ecx, [ebx - 1]
push ecx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call fcn.00409150
mov eax, dword [ebp - 4]
inc eax
push eax
push edi
mov edi, dword [ebp - 8]
lea eax, [edi + ebx - 1]
push eax
call fcn.00409150
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004050ca
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x405257
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040394e
push ebx
call fcn.0040394e
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40557c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp dword [esi + 4], 0xffffffff
push ebx
push edi
je 0x4056aa
cmp dword [esi], 0xffffffff
je 0x4056aa
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp + 8]
call fcn.0040b04f
add esp, 0x10
test edx, edx
jg 0x4055bc
jl 0x4056aa
test eax, eax
jb 0x4056aa
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.00409ff7
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4056aa
mov edi, dword [esi + 4]
push edi
push ebx
push dword [ebp + 8]
call fcn.004172cb
add esp, 0xc
cmp eax, edi
jne 0x4056a3
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp eax, ecx
jne 0x405608
mov eax, dword [ebp + 0xc]
mov byte [edi + ebx], cl
cmp eax, ecx
je 0x405601
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov eax, ebx
jmp 0x4056ac
cmp eax, 8
jne 0x4056a3
push 0x38
push str.1.2.8
lea eax, [ebp - 0x3c]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
call fcn.004066b3
add esp, 0x10
test eax, eax
js 0x4056a3
mov edi, dword [esi]
lea eax, [edi + 1]
push eax
call fcn.00409ff7
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4056a3
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push 1
push eax
mov dword [ebp - 0x2c], edi
call fcn.0040680b
pop ecx
pop ecx
push ebx
test eax, eax
jns 0x405674
call fcn.00408da6
push dword [ebp - 4]
call fcn.00408da6
pop ecx
jmp 0x4056a9
mov eax, dword [esi]
mov edi, dword [ebp - 4]
mov byte [edi + eax], 0
call fcn.00408da6
lea eax, [ebp - 0x3c]
push eax
call fcn.00407ab7
pop ecx
pop ecx
test eax, eax
jns 0x405694
push edi
jmp 0x4056a4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40569f
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, edi
jmp 0x4056ac
push ebx
call fcn.00408da6
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x405723
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push edi
sub eax, 0x14
push 0
sbb ecx, 0
push ecx
push eax
push dword [esp + 0x18]
call fcn.0040b04f
mov edi, edx
add esp, 0x10
mov ebx, eax
test edi, edi
jg 0x405751
jl 0x40578f
test ebx, ebx
jb 0x40578f
push 0x14
push esi
push dword [esp + 0x14]
call fcn.004172cb
add esp, 0xc
test eax, eax
js 0x40578f
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, 0x7064b50
jne 0x40578f
mov eax, ebx
mov edx, edi
jmp 0x405794
or eax, 0xffffffff
or edx, eax
pop edi
pop ebx
ret
Function at 0x405797
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push edi
call fcn.0040b04f
mov ebx, edx
add esp, 0x10
mov dword [ebp - 0xc], eax
test ebx, ebx
jg 0x4057ca
jl 0x4057c0
test eax, eax
jae 0x4057ca
or eax, 0xffffffff
or edx, eax
jmp 0x405916
push esi
mov esi, dword [ebp + 0xc]
push 0x16
push esi
push edi
call fcn.004172cb
add esp, 0xc
test eax, eax
js 0x405910
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, 0x6054b50
jne 0x40582c
mov eax, esi
call fcn.004056b0
test eax, eax
je 0x405824
push ebx
push dword [ebp - 0xc]
push edi
call fcn.00405723
add esp, 0xc
jmp 0x405915
mov eax, dword [ebp - 0xc]
jmp 0x405955
push 2
push 0
push 0
push edi
call fcn.0040b04f
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jg 0x405851
jl 0x405910
test esi, esi
jb 0x405910
mov edi, 0x10015
test ebx, ebx
jg 0x405867
jl 0x405860
cmp esi, edi
jae 0x405867
mov dword [ebp - 0xc], esi
mov eax, ebx
jmp 0x40586c
mov dword [ebp - 0xc], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
neg ecx
adc eax, 0
push 2
neg eax
push eax
push ecx
push dword [ebp + 8]
call fcn.0040b04f
add esp, 0x10
test edx, edx
jg 0x405893
jl 0x405910
test eax, eax
jb 0x405910
push edi
call fcn.00409ff7
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
test edi, edi
je 0x405910
push dword [ebp - 0xc]
push edi
push dword [ebp + 8]
call fcn.004172cb
add esp, 0xc
test eax, eax
jns 0x4058b9
push edi
jmp 0x40590a
add eax, edi
mov dword [ebp - 8], eax
lea edi, [eax - 0x16]
jmp 0x405902
cmp byte [edi], 0x50
jne 0x405901
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x405901
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x14]
shl ecx, 8
or ecx, edx
lea ecx, [ecx + edi + 0x16]
cmp ecx, eax
je 0x40591a
dec edi
cmp edi, dword [ebp - 4]
jae 0x4058c3
push dword [ebp - 4]
call fcn.00408da6
pop ecx
or edx, 0xffffffff
mov eax, edx
pop esi
pop edi
pop ebx
leave
ret
push 0x16
push edi
push dword [ebp + 0xc]
call fcn.00409150
push dword [ebp - 4]
call fcn.00408da6
mov eax, dword [ebp - 8]
sub eax, edi
cdq
add esp, 0x10
sub esi, eax
mov eax, dword [ebp + 0xc]
sbb ebx, edx
call fcn.004056b0
test eax, eax
je 0x405953
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0xc]
jmp 0x405817
mov eax, esi
mov edx, ebx
jmp 0x405915
Function at 0x4096b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4096c2
repz ret
jmp fcn.0041134d

Function at 0x40adce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40adf5
call fcn.0040aae4
mov dword [eax], esi
call fcn.0040aad1
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040d2a6
mov eax, esi
jmp 0x40ae4a
test dword [ebp + 0xc], 0xfffffff9
jne 0x40addb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ae22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040aaf7
pop ecx
call fcn.0040aad1
mov eax, dword [eax]
jmp 0x40ae4a
test al, 0x10
jne 0x40ae48
test al, 1
je 0x40ae48
test byte [ebp + 0xc], 2
je 0x40ae48
call fcn.0040aae4
mov dword [eax], 5
call fcn.0040aad1
mov dword [eax], 0xd
jmp 0x40ae19
xor eax, eax
pop esi
pop ebp
ret