joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, eax
mov edi, ecx
call ebx
push 0x4460ec
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [edi + edi*4]
mov eax, dword [ecx*4 + 0x44608c]
cmp eax, esi
lea ecx, [ecx*4 + 0x446088]
ja 0x407808
mov eax, esi
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0xc]
cmp eax, esi
jb 0x407814
mov eax, esi
mov edx, dword [ecx]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 8]
imul eax, edx
lea edi, [edx + 1]
add eax, esi
xor edx, edx
div edi
cmp dword [ebp + 8], 0
mov dword [ecx], edi
mov dword [ecx + 8], eax
je 0x407837
add dword [ecx + 0x10], 1
push 0x4460ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call ebx
mov ecx, eax
sub ecx, dword [ebp - 4]
mov eax, dword [0x4460dc]
cmp eax, ecx
ja 0x407854
mov eax, ecx
mov dword [0x4460dc], eax
mov eax, dword [0x4460e4]
cmp eax, ecx
jb 0x407864
mov eax, ecx
mov dword [0x4460e4], eax
mov eax, dword [0x4460d8]
lea esi, [eax + 1]
imul eax, dword [0x4460e0]
add eax, ecx
xor edx, edx
div esi
pop edi
mov dword [0x4460d8], esi
pop esi
pop ebx
mov dword [0x4460e0], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4081e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x428040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 2
push ebx
push edi
mov dword [esp + 0x44], ebx
call fcn.004078f0
cmp eax, ebx
mov dword [esp + 0xc], eax
je 0x40824a
push edi
call fcn.00407d60
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x40824a
mov esi, eax
jmp 0x408312
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x3c], 1
mov eax, dword [esi]
lea ecx, [esp + 0x20]
call fcn.00408370
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x408276
mov ecx, dword [esp + 0x28]
sub ecx, eax
jne 0x408280
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
call sub.MSVCR80.dll_memcpy
mov ecx, dword [esp + 0x30]
add esp, 0xc
cmp ecx, ebx
je 0x4082a0
mov edx, dword [esp + 0x28]
sub edx, ecx
jne 0x4082aa
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
push eax
push ecx
push ecx
call fcn.00417c60
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, ebx
je 0x4082c7
mov ecx, dword [esp + 0x28]
sub ecx, eax
jne 0x4082d1
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x24]
mov edx, dword [ebp + 8]
push esi
push eax
push edx
mov ecx, edi
call fcn.00407f80
mov byte [esp + 0x3c], bl
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
mov dword [esp + 0xc], eax
mov esi, eax
je 0x408306
mov eax, dword [esp + 0x2c]
sub eax, ecx
push eax
push ecx
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_char_::deallocate_char___unsigned_int_]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x18]
mov ecx, 2
call fcn.004077d0
mov ecx, dword [esp + 0x34]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4088a0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4088ec
lea ecx, [esp]
push ecx
call eax
jmp 0x4088f6
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 6
je 0x408911
cmp ax, 0xa
je 0x408911
cmp ax, 9
je 0x408911
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x410d2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4430f4]
jne 0x410d34
repz ret
jmp fcn.00411206

Function at 0x411bf0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0xa
push ebp
push 0xe
push 0x400
mov ebx, ecx
mov dword [esi], eax
call edi
push 0xa
push ebx
push 0xf
push 0x400
mov dword [esi + 0xc], ebp
call edi
push 0xa
lea ecx, [esp + 0x10]
push ecx
push 0x12
push 0x400
mov dword [esi + 0x10], ebx
call edi
mov ebx, dword [sym.imp.MSVCR80.dll__wtol]
lea edx, [esp + 0xc]
push edx
call ebx
add esp, 4
push 0xa
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push eax
push 0x1010
push 0x400
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
add esp, 4
push 0xa
lea edx, [esp + 0x10]
push edx
push 0x10
push 0x400
mov dword [esi + 0x14], eax
call edi
mov ax, word [esp + 0xc]
test ax, ax
pop edi
pop ebp
mov dword [esi + 8], 0
lea edx, [esp + 4]
pop ebx
je 0x411cb8
movzx eax, ax
cmp ax, 0x31
jb 0x411cac
cmp ax, 0x39
ja 0x411cac
mov ecx, dword [esi + 8]
movzx eax, ax
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*2 - 0x30]
mov dword [esi + 8], ecx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x411c90
add esp, 0x14
ret
Function at 0x414370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x4143a2
lea esp, [esp]
test cl, 3
je 0x4143a2
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42f8b0]
add ecx, 1
sub esi, 1
jne 0x414380
cmp esi, 0x20
push ebx
push edi
jb 0x41458c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42fcb0]
xor edx, dword [ebx*4 + 0x4300b0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42f8b0]
add ecx, 4
xor edx, dword [eax*4 + 0x4304b0]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42fcb0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4300b0]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42f8b0]
add ecx, 4
xor eax, dword [edx*4 + 0x4304b0]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42fcb0]
xor edx, dword [ebx*4 + 0x4300b0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42f8b0]
xor edx, dword [eax*4 + 0x4304b0]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42fcb0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4300b0]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42f8b0]
xor eax, dword [edx*4 + 0x4304b0]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42fcb0]
xor edx, dword [ebx*4 + 0x4300b0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42f8b0]
xor edx, dword [eax*4 + 0x4304b0]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42fcb0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4300b0]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42f8b0]
and edx, 0xff
xor eax, dword [edx*4 + 0x4304b0]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42fcb0]
xor edx, dword [ebx*4 + 0x4300b0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42f8b0]
add ecx, 4
xor edx, dword [eax*4 + 0x4304b0]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42fcb0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4300b0]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42f8b0]
and edx, 0xff
xor eax, dword [edx*4 + 0x4304b0]
sub edi, 1
jne 0x4143b2
cmp esi, 4
jb 0x4145d9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x42fcb0]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4300b0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x42f8b0]
and eax, 0xff
xor edi, dword [eax*4 + 0x4304b0]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x414596
test esi, esi
pop edi
pop ebx
je 0x4145fd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42f8b0]
add ecx, 1
sub esi, 1
jne 0x4145e0
not eax
pop esi
ret
Function at 0x416a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x416a90
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call sub.MSVCR80.dll_memcpy
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x416a5f
sub eax, ebp
jmp 0x416a61
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x416a50
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x416a80
sub eax, ebp
jmp 0x416a82
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x416a71
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x416bc2
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
cmp ebx, ecx
mov dword [esp + 0x10], edx
jbe 0x416ab8
mov ebx, ecx
test ebx, ebx
je 0x416b0c
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x416ada
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.00414620
jmp 0x416af3
cmp eax, 2
jne 0x416afa
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edi + 0x30]
jne 0x416aec
xor eax, eax
jmp 0x416af7
mov edx, ebx
call fcn.00414370
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call sub.MSVCR80.dll_memcpy
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x416b36
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x416b4a
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x416a10
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x416bc2
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x416b91
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x416b71
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x416bc2
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x416bab
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x417ae0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x200
push ebp
mov ebp, dword [esp + 0x210]
push edi
mov edi, dword [esp + 0x20c]
test edi, edi
jne 0x417b06
lea eax, [edi - 3]
pop edi
pop ebp
add esp, 0x200
ret
test eax, eax
jg 0x417b18
pop edi
mov eax, 0xfffffffc
pop ebp
add esp, 0x200
ret
cmp dword [esp + 0x210], 0
jne 0x417b30
pop edi
mov eax, 0xfffffffb
pop ebp
add esp, 0x200
ret
test ebp, ebp
jg 0x417b42
pop edi
mov eax, 0xfffffffa
pop ebp
add esp, 0x200
ret
cmp eax, ebp
jge 0x417b54
pop edi
mov eax, 0xfffffff9
pop ebp
add esp, 0x200
ret
push ebx
xor edx, edx
xor ecx, ecx
push esi
lea ebx, [ebx]
mov al, byte [edx + str.8CEFC9E6_A2B4_4c2a_823C_6903A31139FA]
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0x10], cl
mov esi, 0x26
add ecx, 1
idiv esi
cmp ecx, 0x100
jl 0x417b60
xor ecx, ecx
xor eax, eax
jmp 0x417b90
mov dl, byte [esp + eax + 0x10]
movzx esi, byte [esp + eax + 0x110]
movzx ebx, dl
add esi, ecx
add ebx, esi
mov ecx, ebx
and ecx, 0x800000ff
jns 0x417bb5
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + ecx + 0x10], dl
mov byte [esp + eax + 0x10], bl
add eax, 1
cmp eax, 0x100
jl 0x417b90
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x417c47
mov eax, edi
mov edi, dword [esp + 0x218]
sub edi, eax
mov edi, edi
add ecx, 1
and ecx, 0x800000ff
jns 0x417bf3
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x417c0a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x417c34
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x417be0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x200
ret
Function at 0x417c60
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x200
cmp dword [esp + 0x208], 0
push ebp
mov ebp, dword [esp + 0x210]
jne 0x417c85
mov eax, 0xfffffffd
pop ebp
add esp, 0x200
ret
test eax, eax
jg 0x417c96
mov eax, 0xfffffffc
pop ebp
add esp, 0x200
ret
push edi
mov edi, dword [esp + 0x20c]
test edi, edi
jne 0x417cae
lea eax, [edi - 5]
pop edi
pop ebp
add esp, 0x200
ret
test ebp, ebp
jg 0x417cc0
pop edi
mov eax, 0xfffffffa
pop ebp
add esp, 0x200
ret
cmp eax, ebp
jge 0x417cd2
pop edi
mov eax, 0xfffffff9
pop ebp
add esp, 0x200
ret
push ebx
xor edx, edx
xor ecx, ecx
push esi
jmp 0x417ce0
mov al, byte [edx + str.8CEFC9E6_A2B4_4c2a_823C_6903A31139FA]
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0x10], cl
mov esi, 0x26
add ecx, 1
idiv esi
cmp ecx, 0x100
jl 0x417ce0
xor ecx, ecx
xor eax, eax
jmp 0x417d10
mov dl, byte [esp + eax + 0x10]
movzx esi, byte [esp + eax + 0x110]
movzx ebx, dl
add esi, ecx
add ebx, esi
mov ecx, ebx
and ecx, 0x800000ff
jns 0x417d35
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + ecx + 0x10], dl
mov byte [esp + eax + 0x10], bl
add eax, 1
cmp eax, 0x100
jl 0x417d10
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x417dc7
mov eax, edi
mov edi, dword [esp + 0x218]
sub edi, eax
mov edi, edi
add ecx, 1
and ecx, 0x800000ff
jns 0x417d73
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x417d8a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x417db4
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x417d60
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x200
ret
Function at 0x418eb0
Capabilities:
Move file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push edi
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
call edx
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x418ef0
Capabilities:
Move file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push edi
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x418f20
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push edi
call edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x418fa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
push edi
push 0x208
lea eax, [esp + 0xe]
push 0
push eax
mov esi, ecx
mov word [esp + 0x14], 0
call sub.MSVCR80.dll_memset
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
add esp, 0xc
mov ecx, esi
call eax
test eax, eax
je 0x418ffb
mov edx, dword [esi]
mov eax, dword [edx + 0x2c]
mov ecx, esi
call eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
jmp 0x419010
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jl 0x419067
lea eax, [esp + 8]
lea edx, [eax + 2]
jmp 0x419020
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419020
mov ecx, dword [esp + 0x21c]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [ecx - 1]
cmp esi, eax
lea edx, [esp + 8]
jbe 0x419046
push eax
jmp 0x419047
push esi
mov eax, dword [esp + 0x21c]
push edx
push ecx
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
pop edi
mov eax, esi
pop esi
add esp, 0x20c
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
Function at 0x419220
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x10], 0
jne 0x4192a8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push edi
mov dword [ebx + 0x10], 1
mov esi, 0x443280
mov edi, 5
mov eax, dword [esi - 4]
push 0x104
push esi
push eax
call ebp
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419254
sub eax, edx
sar eax, 1
mov dword [esi - 8], eax
add esi, 0x214
sub edi, 1
jne 0x419243
push str.kernel32.dll
mov dword [ebx + 0x18], 0x443278
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4192a5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call edi
push str.Wow64RevertWow64FsRedirection
push esi
mov dword [ebx + 4], eax
call edi
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebp
cmp dword [ebx + 4], 0
je 0x4192bb
cmp dword [ebx + 8], 0
je 0x4192bb
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x4192c0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
push esi
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call sub.MSVCR80.dll_memset
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
add esp, 0xc
mov ecx, esi
call eax
test eax, eax
jne 0x4192f9
pop esi
add esp, 0x20c
ret
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push str.system32winlogon.exe
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419335
mov eax, 1
pop esi
add esp, 0x20c
ret
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 4]
push eax
mov ecx, esi
call edx
neg eax
sbb eax, eax
add eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x419380
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4193bb
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 4
lea ecx, [esp + 0xc]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41945c
cmp dword [esp + 0x10], edi
jl 0x41945c
jg 0x4193e2
cmp dword [esp + 0xc], 0x40
jb 0x41945c
push ebx
push edi
push edi
push edi
push 2
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41945b
mov edx, dword [esp + 0x10]
push esi
push edx
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x419453
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x41944c
cmp word [esi], 0x5a4d
jne 0x41944c
mov edi, dword [esi + 0x3c]
push 0xf8
add edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x41944c
cmp dword [edi], 0x4550
jne 0x41944c
cmp word [edi + 0x18], 0x20b
sete al
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
pop ebp
add esp, 0xc
ret 4
Function at 0x419550
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
mov eax, dword [esp + 0x120]
cmp eax, 0x80000001
mov dword [esp], ecx
je 0x41957f
cmp eax, 0x80000002
je 0x41957f
call dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add esp, 0x11c
ret 0xc
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
test eax, eax
jne 0x4195a5
mov eax, dword [esp + 0x128]
mov dword [eax], 0
mov eax, 1
add esp, 0x11c
ret 0xc
push ebx
push 0x110
lea ecx, [esp + 0x14]
push 0
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [esp + 0x10]
cmp ebx, 5
jae 0x4195e2
xor eax, eax
pop ebx
add esp, 0x11c
ret 0xc
push ebp
mov ebp, dword [esp + 0x12c]
test ebp, ebp
je 0x4196cb
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4195f7
sub eax, edx
sar eax, 1
je 0x4196cb
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419611
sub eax, edx
sar eax, 1
push esi
mov esi, eax
cmp word [ebp + esi*2 - 2], 0x5c
push edi
jne 0x419630
mov edi, ebp
jmp 0x41965d
lea ebx, [esi + 2]
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
push esi
push ebp
mov edi, eax
push ebx
push edi
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
mov word [edi + esi*2], 0x5c
mov word [edi + esi*2 + 2], 0
mov ebx, dword [esp + 0x30]
add esp, 0x14
mov eax, dword [esp + 0x10]
call fcn.00418da0
cmp ebx, 6
jb 0x419689
jne 0x419674
cmp dword [esp + 0x20], 0
je 0x419689
mov esi, dword [esp + 0x138]
push esi
push edi
push 0x4440c0
mov ebx, 0x41
jmp 0x41969c
mov esi, dword [esp + 0x138]
push esi
push edi
push 0x443ce0
mov ebx, 0x3e
call fcn.00418d40
test eax, eax
jne 0x4196ab
mov dword [esi], 4
cmp edi, ebp
je 0x4196b9
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c
ret 0xc
mov ecx, dword [esp + 0x130]
pop ebp
mov dword [ecx], 4
mov eax, 1
pop ebx
add esp, 0x11c
ret 0xc