joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005866b0
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473ea8
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005866b0
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x58038b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473f4e
cmp edi, dword [esi + 0x7c]
jge 0x473f4e
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004887f2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004887f2
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005866b0
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005866b0
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473ea0
jmp 0x473e70
call fcn.0048ca19
int3
Function at 0x48b1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059da70
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b268
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059da70
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0059774b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b30e
cmp edi, dword [esi + 0x7c]
jge 0x48b30e
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049fbb2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049fbb2
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da70
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da70
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b260
jmp 0x48b230
call fcn.004a3dd9
int3
Function at 0x4a16a8
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffe862, 0x45
jg 0x4a16f7
call 0xfb9595f2
sti
arpl word [edi + 0x3c], sp
pop es
or dword [ecx], ebx
pop ds
mov dword [eax], edi
jae 0x4a16a6
salc
cmpsd dword [esi], dword es:[edi]
sub edi, dword [eax]
in eax, dx
sub dword [edx], esi
mov bl, 0xdd
pop ebx
add dword [ecx + edx*4 - 0x1e62ad19], 7
loope 0x4a16d3
scasb al, byte es:[edi]
daa
xor dl, bh
inc edx
adc dword [edi], edi
outsd dx, dword [esi]
lds ebx, [eax]
dec byte [edx - 0x73f89a85]
jle fcn.004a1662
test byte [ebp + esi*2 - 0x2f], ah
jne 0x4a16b2
inc ecx
xchg dword [edi + ebp - 0x4b], esi
inc ecx
cmp eax, 0x7ac02849
adc byte [ebx + edi*4 + 0xd866c97], al
push ds
lodsb al, byte [esi]
push 0xffffffffffffffcf
les esp, [edx - 0x4c]
sbb al, 0x3e
add eax, 0xbf226a37
leave
arpl word [edi - 0x52], sp
sahf
push esp
scasb al, byte es:[edi]
pop es
or al, 0x28
jnp 0x4a16ca
clc
aad 0x38
and al, 0x8e
adc al, 0x2a
lcall 0x356d, 0x2851d762
test al, 0x6a
xchg edi, eax
adc al, 0xa6
outsd dx, dword [esi]
cmp byte [edx - 0x32a17c82], 0xa2
sbb dh, bl
sub edi, 0xd90acd74
mov bh, 0xad
popal
mov esi, 0x86977f79
add eax, 0x69383ba2
sbb dh, byte [edi + ebp*2 + 0x2f]
in al, 0x44
jge 0x4a16dd
mov eax, 0x12f5ae12
invalid

Function at 0x4a1b55
Capabilities:
Encode data using xor

Disassembly:
push ebp
clc
xor eax, eax
pop edi
mov ax, word [ecx + edx*2]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebp, esp
push ecx
push ebx
push esi
jmp fcn.0066913d
cmp byte [edi - 0x29], dl
push esp
out dx, al
jae 0x4a1a9a
sti
test eax, 0xaae4b7bf
jb 0x4a1b4b
or eax, 0xfe7a777d
pushfd
salc
stosb byte es:[edi], al
mov esp, eax
xchg ebp, eax
invalid
push 0x18
cld
xchg ebp, eax
add eax, 0x37bbc3ed
aaa
pop edi
pop ds
or al, 0x6c
insb byte es:[edi], dx
js 0x4a1ac1
ja 0x4a1b2f
xor bh, byte [esi + 0x43]
lcall 0x732b, 0x8cf111ca
ljmp 0xee1a
jae 0x4a1b37
xchg dword [ebx], edi
xchg esi, eax
sbb ch, dh
cmp eax, 0x3f397a92
jp 0x4a1b90
aas
outsb dx, byte [esi]
in eax, dx
jle 0x4a1b3b
inc edi
xor ah, dh
cmp eax, 0x9ae49d0b
leave
movsb byte es:[edi], byte [esi]
invalid
Function at 0x4a2280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b4b50
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a2348
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b4b50
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ae82b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js fcn.004a23ee
cmp edi, dword [esi + 0x7c]
jge fcn.004a23ee
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b6c92
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b6c92
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4b50
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4b50
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a2340
jmp 0x4a2310
Function at 0x4b8f07
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf3e0
push 0x4b8e1c
mov eax, dword fs:[0]
add byte [eax], al
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c5d74], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c5d70], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c5d6c], ecx
shr eax, 0x10
mov dword [0x4c5d68], eax
push 1
call fcn.004ba00b
pop ecx
test eax, eax
jne 0x4b8f5f
push 0x1c
call fcn.004b9021
pop ecx
call fcn.004b9dc8
test eax, eax
jne 0x4b8f70
push 0x10
call fcn.004b9021
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b9c0c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c6434], eax
call fcn.004b9ada
mov dword [0x4c5d58], eax
call fcn.004b988d
call fcn.004b97d4
call fcn.004b94e4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b977c
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b8fbf
movzx eax, word [ebp - 0x2c]
jmp 0x4b8fc2
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b9511
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9604
pop ecx
pop ecx
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4c714cf0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xa9b1a7d
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x51dea0
Capabilities:
Terminate process

Disassembly:
test byte [0x5cc2e8], 0x20
jne 0x51debe
vmovq xmm0, xmm0
vcvttpd2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
mov ecx, esp
add esp, 0xfffffff8
and esp, 0xfffffff8
movsd qword [esp], xmm0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov esp, ecx
btr edx, 0x1f
sbb ecx, ecx
cmp edx, 0x41e00000
jae 0x51df1e
cvttsd2si eax, xmm0
cdq
ret
mov ecx, edx
bts edx, 0x14
shr ecx, 0x14
and edx, 0x1fffff
sub ecx, 0x433
jge 0x51df18
neg ecx
push ebx
xor ebx, ebx
shrd ebx, eax, cl
je 0x51df11
cvttss2si ebx, dword [0x532bec]
pop ebx
shrd eax, edx, cl
shr edx, cl
ret
shld edx, eax, cl
shl eax, cl
ret
cmp edx, 0x43e00000
jae 0x51df37
test ecx, ecx
je 0x51dee8
call 0x51dee8
neg eax
adc edx, 0
neg edx
ret
jecxz 0x51df3f
ja 0x51df3f
test eax, eax
je 0x51df47
cvttss2si ecx, dword [0x532be8]
mov edx, SysReAllocStringLen
xor eax, eax
ret

Function at 0x51e623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51e662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51e662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51e662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51e662
cmp dword [ecx + 0x74], 0xe
jbe 0x51e662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x52adc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52aded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52aded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x60954c
Capabilities:
Encode data using xor

Disassembly:
test dword [esi - 0x45b67c3b], 0xdee71256
int3
or al, 0xa3
aad 7
mov dh, byte [esi + 0x3f]
ja 0x6094b3
add byte ds:[eax], ah
cmpsd dword [esi], dword es:[edi]
jne 0x609572
push esi
daa
dec ecx
mov bl, 0x69
fidivr word [ecx + 0x41d98041]
xchg edx, eax
hlt
out 0xef, al
mov dh, 0x53
call 0xe64b715c
mov dword [ebx - 1], eax
ror byte [esi - 0x531908d7], 1
imul byte [edi]
jo 0x609515
add dword [ecx + 0x34], ebp
jne 0x609526
adc byte [si - 0x6a], al
add esp, dword [eax + 0x30]
lds eax, [edi + 0x7e]
salc
outsb dx, byte [esi]
invalid
Function at 0x405140
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x150
mov eax, dword [0x466df4]
xor eax, esp
mov dword [esp + 0x14c], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp]
shl edx, 4
sub edx, dword [esp]
shl edx, 2
mov dword [0x468368], edx
mov dword [0x46836c], edx
cmp eax, 2
jne 0x40518e
mov ecx, dword [esp + 0xa8]
shl ecx, 4
sub ecx, dword [esp + 0xa8]
jmp 0x40519e
cmp eax, 1
jne 0x4051a6
mov ecx, dword [esp + 0x54]
shl ecx, 4
sub ecx, dword [esp + 0x54]
lea eax, [edx + ecx*4]
mov dword [0x46836c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 6
push 0x465458
push 0xe
push 0x400
call esi
push 6
push 0x465464
push 0xf
push 0x400
call esi
push 0xa0
lea eax, [esp + 0xb8]
push 0
push eax
call fcn.00424c20
add esp, 0xc
lea eax, [esp + 0xb4]
push 0x50
push eax
push 0x1f
push 0x400
call esi
movzx eax, word [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov ecx, dword [0x468360]
cmp ax, 0x64
push 0x50
lea eax, [esp + 0xb8]
mov edi, 1
push eax
push 0x1003
cmove ecx, edi
push 0x400
mov dword [0x468360], ecx
call esi
cmp word [esp + 0xb4], 0x48
mov eax, dword [0x468364]
cmove eax, edi
cmp dword [0x468360], 1
pop edi
mov dword [0x468364], eax
pop esi
jne 0x40527a
push 0x3c
push dword [0x46513c]
push 0x465040
call fcn.0040bab0
mov eax, dword [0x468364]
add esp, 0xc
mov dword [0x465148], 0x445e78
cmp eax, 1
jne 0x40529e
push 0x3c
push dword [0x465144]
push str.hh:mm:ss_tt
call fcn.0040bab0
mov eax, dword [0x465144]
add esp, 0xc
mov dword [0x468384], eax
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00422f50
add esp, 0x150
ret

Function at 0x4059a0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x194
mov eax, dword [0x466df4]
xor eax, esp
mov dword [esp + 0x190], eax
push ebp
mov ebp, dword [esp + 0x1ac]
push esi
mov esi, dword [esp + 0x1a0]
push edi
mov edi, dword [esp + 0x1b0]
call fcn.0041c790
test al, al
je 0x405a5c
test esi, esi
jne 0x4059f5
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x4059f5
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x405a14
test edi, edi
je 0x4059ff
cmp word [edi], 0
jne 0x405a14
push 0xc8
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x1ac]
mov ebx, eax
or ecx, 0x10000
push ecx
push edi
push ebp
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test ebx, ebx
je 0x405a41
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00422f50
add esp, 0x194
ret
mov eax, dword [esp + 0x1ac]
test eax, eax
jne 0x405a9f
mov ecx, dword [esp + 0x1a8]
and ecx, 0xf
cmp ecx, 4
je 0x405a9a
cmp ecx, 3
je 0x405a9a
cmp ecx, 5
pop edi
sete al
pop esi
inc eax
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00422f50
add esp, 0x194
ret
mov eax, 6
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00422f50
add esp, 0x194
ret
Function at 0x407560
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x407677
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
movzx ecx, di
shr edi, 0x10
test ebp, ebp
je 0x40766c
push ebx
mov edx, 0x15b0
cmp ebp, edx
cmovb edx, ebp
sub ebp, edx
cmp edx, 0x10
jb 0x40762e
mov ebx, edx
shr ebx, 4
movzx eax, byte [esi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add edi, ecx
add esi, 0x10
add ecx, eax
add edi, ecx
sub ebx, 1
jne 0x4075a0
test edx, edx
je 0x40763f
movzx eax, byte [esi]
inc esi
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x407632
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebp, ebp
jne 0x407586
pop ebx
shl edi, 0x10
or edi, ecx
mov eax, edi
pop edi
pop ebp
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x408120
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [esi + 0xc]
push dword [esi + 0x10]
call edi
test eax, eax
je 0x408157
cmp eax, dword [esi + 0xc]
jb 0x40815e
push 0
add eax, eax
mov ecx, esi
push eax
call fcn.004032d0
test al, al
je 0x408157
push dword [esi + 0xc]
push dword [esi + 0x10]
call edi
test eax, eax
jne 0x408136
pop edi
xor al, al
pop esi
ret 4
mov eax, dword [esp + 0xc]
push ebx
push ebp
test eax, eax
je 0x4081fc
movzx ecx, word [eax]
test cx, cx
je 0x4081fc
cmp ecx, 0x5c
lea edi, [eax + 2]
mov ecx, esi
cmovne edi, eax
call fcn.004078a0
test al, al
je 0x408205
push dword [esi + 0x10]
call fcn.0040bc90
add esp, 4
mov ebp, eax
test edi, edi
je 0x4081aa
push edi
call fcn.0040bc90
add esp, 4
mov ebx, eax
jmp 0x4081ac
xor ebx, ebx
lea eax, [ebp + 1]
mov dword [esi + 4], ebp
add eax, ebx
cmp eax, dword [esi + 0xc]
jbe 0x4081de
push dword [esi + 0x10]
call fcn.0040bb80
add esp, 4
mov dword [esi + 4], eax
call fcn.00413f80
push eax
lea eax, [ebp + 1]
mov ecx, esi
add eax, ebx
push eax
call fcn.004035e0
test al, al
je 0x408205
mov eax, dword [esi + 0x10]
lea esi, [eax + ebp*2]
test edi, edi
je 0x4081f6
lea eax, [ebx + ebx]
push eax
push edi
push esi
call fcn.004246a0
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2], ax
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
ret 4
pop ebp
pop ebx
pop edi
xor al, al
pop esi
ret 4
Function at 0x408380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4427db
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x108
push 2
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x234]
call fcn.00403220
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x224]
mov dword [ebp - 4], ecx
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x408475
push dword [edi + 0xc]
mov ebx, dword [ebp - 0x224]
push dword [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x408453
test ebx, ebx
je 0x408448
push ebx
call fcn.0040bc90
mov esi, eax
add esp, 4
test esi, esi
je 0x408448
push 0
lea ecx, [esi + 1]
push ecx
mov ecx, edi
call fcn.004032d0
test al, al
je 0x408453
add esi, esi
push esi
push ebx
push dword [edi + 0x10]
call fcn.004246a0
mov eax, dword [edi + 0x10]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x408453
mov eax, dword [edi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 4], ecx
mov esi, dword [edi + 0x10]
push esi
call fcn.0040bc90
add esp, 4
test eax, eax
je 0x408464
dec eax
cmp word [esi + eax*2], 0x5c
jne 0x408471
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
jmp 0x408477
xor bl, bl
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.004032b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f50
mov esp, ebp
pop ebp
ret

Function at 0x4084b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4084ce
mov eax, dword [esi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x4084e6
push eax
mov ecx, esi
call fcn.004077e0
test al, al
jne 0x4084e6
pop esi
ret 4
mov al, 1
pop esi
ret 4
Function at 0x409040
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442840
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x466df4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push str.ROOTCIMV2
mov dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x40919a
mov ecx, dword [ebx + 0xc]
lea edi, [ebx + 0xc]
test ecx, ecx
je 0x40909c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
push 0x4473ac
push 1
push 0
push 0x451f4c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x40911e
mov dword [ebp - 0x20], 0x4477bc
mov dword [ebp - 0x1c], 0
push str.WbemLocator
push str.Failed_to_instantiate_COM_object
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push str._s__Message:___s_
push eax
call fcn.0040cd80
add esp, 0x10
test al, al
je 0x409109
push 0
lea ecx, [ebp - 0x20]
call fcn.0040cea0
push eax
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00405b50
test al, al
je 0x409109
mov bl, 1
jmp 0x40910b
xor bl, bl
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.0040c7b0
test bl, bl
je 0x40919a
mov ebx, dword [ebp + 8]
mov edx, dword [edi]
mov edi, dword [ebp - 0x14]
add edi, 0x14
mov dword [ebp + 8], edx
mov ecx, dword [edi]
test ecx, ecx
je 0x409138
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0
mov eax, dword [edx]
push esi
push edx
call dword [eax + 0xc]
test eax, eax
jns 0x409169
push 0
push 0x446e84
push eax
mov ecx, ebx
call fcn.00405b50
test al, al
je 0x40919a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x409196
push 0
push 0x446e84
push eax
mov ecx, ebx
call fcn.00405b50
test al, al
je 0x40919a
mov bl, 1
jmp 0x40919c
xor bl, bl
test esi, esi
je 0x4091a7
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4