joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402461
Capabilities:
Get file version info

Disassembly:
mov eax, 0x47c568
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x420
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.00477178
and dword [ebp - 4], 0
lea eax, [ebp - 0x22c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x402585
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push esi
lea eax, [ebp - 0x22c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4024eb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40257e
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push 0x49d6b0
lea eax, [ebp - 0x42c]
push 0xff
push eax
call fcn.0041a600
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40257e
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x40257e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::CString_3
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004771a2
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::CString
push 0x49d6ac
push 0x49d6a8
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::Replace
push 0x4a5e60
push 0x49d6a4
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::Replace
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea eax, [ebp - 0x10]
lea ecx, [ebx + 0x60]
push eax
call fcn.004771a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x402650
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
and word [ebp - 0x244], 0
push esi
push edi
mov dword [ebp - 4], ecx
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x242]
rep stosd dword es:[edi], eax
mov esi, 0x11c
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x144]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4026c0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], 0x114
push eax
call esi
test eax, eax
je 0x4027df
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4026e3
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x4026ed
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
xor edi, edi
mov esi, 0x49d2fc
mov eax, dword [ebp - 0x134]
mov ebx, 0x80
cmp eax, dword [esi - 0x14]
jne 0x402750
mov eax, dword [esi]
test al, 1
jne 0x402714
movzx ecx, byte [ebp - 0x2a]
cmp ecx, dword [esi - 0x10]
jne 0x402750
test al, 2
je 0x402725
mov eax, dword [ebp - 0x140]
cmp eax, dword [esi - 0xc]
jbe 0x40275e
jmp 0x402750
test al, 4
je 0x402736
mov eax, dword [ebp - 0x140]
cmp eax, dword [esi - 0xc]
jae 0x40275e
jmp 0x402750
push dword [esi - 0xc]
call fcn.004025ac
test eax, eax
pop ecx
je 0x402750
push dword [esi - 8]
call fcn.004025fe
test eax, eax
pop ecx
jne 0x40275e
add esi, 0x18
inc edi
cmp esi, 0x49d4c4
jl 0x4026f5
jmp 0x402778
lea eax, [edi + edi*2]
push dword [eax*8 + 0x49d2f8]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.0041a530
add esp, 0xc
cmp edi, 0x13
jb 0x402791
push str.WINDOWS
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.0041a530
jmp 0x4027c9
lea eax, [edi + edi*2]
test byte [eax*8 + 0x49d2fc], 0x20
jne 0x4027cc
movzx eax, word [ebp - 0x28]
test eax, eax
je 0x4027b7
cmp eax, 6
je 0x4027b0
cmp eax, 9
jne 0x4027cc
push 0x49d738
jmp 0x4027bc
push 0x49d730
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.0041a380
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x64]
call sub.MFC42u.DLL_CString::operator_1
pop ebx
pop edi
pop esi
leave
ret

Function at 0x406561
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x40657e
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x406581
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x40659e
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 0xc
Function at 0x408067
Capabilities:
Get thread local storage value
Log keystrokes via polling

Disassembly:
mov eax, 0x47cb6d
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x487ae8
push 0
mov dword [ebp - 4], 6
call fcn.0040955c
call fcn.00409737
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
call fcn.00409023
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0xf0
je 0x4080c4
push 0
push 2
push 0
push 0x10
call dword [sym.imp.USER32.dll_keybd_event]
lea edi, [esi + 0x32d0]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x487544
mov ecx, edi
mov byte [ebp - 4], 7
call sub.MFC42u.DLL_CGdiObject::DeleteObject
push fcn.0040afea
push 0x2f
lea eax, [esi + 0x3cc]
push 0x100
push eax
mov dword [edi], 0x487530
mov byte [ebp - 4], 4
call fcn.00475d0c
lea ecx, [esi + 0x2cc]
mov byte [ebp - 4], 3
call fcn.0040afea
lea ecx, [esi + 0x1cc]
mov byte [ebp - 4], 2
call fcn.0040afea
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 1
call fcn.0040afea
and byte [ebp - 4], 0
push fcn.0040981d
push 4
lea eax, [esi + 0x7c]
push 0x14
push eax
call fcn.00475d0c
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00477160
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x408f26
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
test eax, eax
mov esi, ecx
je 0x40901e
mov ecx, dword [esi + 0x32e4]
cmp dword [ecx + 4], 0
je 0x40901e
push ebx
mov bl, byte [eax]
push ebp
push edi
movsx di, bl
push edi
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ebp, dword [esi + 0x174]
mov byte [esp + 0x13], al
xor eax, eax
cmp ebp, 2
sete al
xor ecx, ecx
cmp dword [esi + 0x274], 2
push 1
pop edx
sete cl
cmp eax, edx
jne 0x408f7f
test ecx, ecx
je 0x408fa3
test eax, eax
jne 0x408f91
cmp ecx, edx
jne 0x408fc7
cmp bl, 0x61
jl 0x408fc7
cmp bl, 0x7a
jle 0x408fa3
cmp eax, edx
jne 0x408fc7
cmp ecx, edx
jne 0x408fc7
cmp bl, 0x61
jl 0x408fa3
cmp bl, 0x7a
jle 0x408fc7
push str.CDlgSoftKeyboard::SendKey____Shifted_
push 0x21c
push str.E:_svnSoftwareProjectsSZCATrunkModulesEsManagerWindowsEsUIMidwareUiMidwareUIMfcDlgSoftKeyboard.cpp
push edx
call fcn.0041ade0
mov eax, dword [esp + 0x28]
add esp, 0x10
movsx ax, byte [eax + 1]
push eax
jmp 0x408fc8
push edi
mov eax, dword [esi + 0x32e4]
mov ecx, dword [eax + 4]
call fcn.0040aa6b
pop edi
cmp ebp, 2
pop ebp
pop ebx
jne 0x408ffe
and dword [esi + 0x174], 0
and byte [esi + 0x18c], 0
lea ecx, [esi + 0xcc]
call fcn.0040b17f
and byte [esi + 0x32cc], 0
movzx eax, byte [esp + 7]
push eax
push eax
push str.CDlgSoftKeyboard::SendKey____char_:_c_0x_x_
push 0x22b
push str.E:_svnSoftwareProjectsSZCATrunkModulesEsManagerWindowsEsUIMidwareUiMidwareUIMfcDlgSoftKeyboard.cpp
push 1
call fcn.0041ade0
add esp, 0x18
pop esi
pop ecx
ret 4
Function at 0x409485
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebx + 0x32e4]
mov ecx, dword [ecx + 8]
cmp esi, ecx
jne 0x409558
cmp eax, ecx
jne 0x409558
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call sub.MFC42u.DLL_CWnd::FromHandle
mov ecx, dword [ebx + 0x32e4]
cmp dword [ecx + 4], eax
jne 0x409558
call sub.KERNEL32.dll_GetTickCount
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
push 0x2a
cdq
pop ecx
idiv ecx
add dl, 0x30
cmp dl, 0x30
jbe 0x4094f7
cmp dl, 0x39
jb 0x409501
cmp dl, 0x41
jbe 0x4094d1
cmp dl, 0x5a
jae 0x4094d1
push edi
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
push 1
rep stosd dword es:[edi], eax
movzx si, dl
pop edi
mov word [ebp - 0x34], si
mov dword [ebp - 0x38], edi
call sub.KERNEL32.dll_GetTickCount
push 2
mov word [ebp - 0x18], si
pop esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], esi
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x32e4]
push esi
mov ecx, dword [eax + 4]
call fcn.0040ab5c
lea eax, [ebp - 0x38]
push 0x1c
push eax
push esi
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4095bc
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x274]
cmp ax, 1
jne 0x4095e0
cmp ecx, 2
je 0x4095ec
mov byte [esi + 0x32cd], al
jmp 0x4095ec
cmp ecx, 2
jne 0x4095ec
and byte [esi + 0x32cd], 0
mov ecx, esi
call fcn.00409187
pop esi
ret

Function at 0x40ccf6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
lea eax, [ebp + 0xc]
push esi
push eax
mov esi, 0x400
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push esi
push eax
call fcn.0041a720
push 0x49e83c
lea eax, [ebp - 0x800]
push esi
push eax
call fcn.0041a380
add esp, 0x1c
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
leave
ret

Function at 0x417730
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x214
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x14]
pop ecx
test eax, eax
je 0x417755
mov ecx, 0x85
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
jmp 0x417757
xor edi, edi
push str.CUiServerExe::DeleteSession
mov esi, str.E:_svnSoftwareProjectsSZCATrunkModulesEsManagerWindowsEsUIMidwareUiUIFrameworkUiServerExe.cpp
push 0x1e9
push esi
push 1
call fcn.0041ade0
add esp, 0x10
test ebx, ebx
je 0x4177a4
mov eax, dword [ebx + 0x208]
test eax, eax
je 0x4177a4
push eax
push ebx
push str.CUiServerExe::DeleteSession__pblkSessInfo0x_08x__hSessionThread0x_08x
push 0x1ee
push esi
push 1
call fcn.0041ade0
push edi
push 0
push 0x4176b5
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x419ca0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, edx
dec edx
test ecx, ecx
je 0x419cc9
mov ecx, dword [esp + 4]
push ebx
push esi
sub ecx, eax
lea esi, [edx + 1]
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x419cba
pop esi
pop ebx
ret 0xc

Function at 0x41aac0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x114
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x14
mov dword [esp + 0x10], 0
stosb byte es:[edi], al
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], esi
call dword [sym.imp.MSVCRT.dll_malloc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
push eax
call fcn.00420af0
mov ebp, dword [esp + 0x13c]
add esp, 0xc
test ebp, ebp
jne 0x41ab2a
pop edi
pop esi
mov eax, 0xe0600007
pop ebp
add esp, 0x114
ret 0x10
mov edx, dword [esp + 0x128]
test edx, edx
je 0x41ab5f
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41ab5f
mov ecx, dword [esp + 0x124]
lea eax, [esp + 0x1c]
push 0x104
push eax
push edx
push ecx
call fcn.00421340
lea esi, [esp + 0x1c]
push esi
lea edx, [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
mov edx, dword [esp + 0x12c]
xor ecx, ecx
cmp eax, 0xb7
mov eax, dword [esp + 0x14]
setne cl
push eax
mov dword [edx], ecx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x10]
add esp, 4
test eax, eax
je 0x41abb0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call fcn.00420a20
add esp, 4
mov dword [ebp], esi
test esi, esi
jne 0x41abce
call edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x114
ret 0x10
Function at 0x41b4c0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov edx, dword [esp + 0x420]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x220]
mov dword [esp + 0x21c], ebx
cmp edx, ebx
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
je 0x41b66d
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41b66d
mov ebp, dword [esp + 0x428]
cmp ebp, ebx
je 0x41b66d
mov esi, dword [esp + 0x42c]
cmp esi, ebx
je 0x41b66d
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x118]
mov edi, edx
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00421740
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x118]
lea eax, [esp + 0x14]
push edx
push 0x104
push eax
call fcn.0041a280
push str..bin
lea ecx, [esp + 0x24]
push 0x104
push ecx
call fcn.0041a280
add esp, 0x18
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push 0x4a084c
push edx
push eax
call fcn.00421a50
cmp eax, ebx
jne 0x41b672
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x21c]
lea edx, [esp + 0x21c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push ecx
push 0x200
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x438]
add esp, 0x14
cmp eax, 1
mov dword [esp + 0x10], ebx
jne 0x41b63b
push esi
push ebp
lea ecx, [esp + 0x224]
push 4
push ecx
call fcn.00419f80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
cmp eax, 2
jne 0x41b65e
push esi
push ebp
lea edx, [esp + 0x228]
push 4
push edx
call fcn.00419f80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret 0x10
mov eax, 0xe0600007
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
Function at 0x41b680
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x40c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x41c]
mov ecx, 0x7f
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0x21c]
mov dword [esp + 0x218], ebx
cmp edx, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], ebx
je 0x41b81c
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41b81c
mov esi, dword [esp + 0x424]
cmp esi, ebx
je 0x41b81c
cmp dword [esp + 0x428], ebx
je 0x41b81c
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x114]
mov edi, edx
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00421740
lea ecx, [esp + 0x10]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push 0x104
push eax
call fcn.0041a280
push str..bin
lea ecx, [esp + 0x20]
push 0x104
push ecx
call fcn.0041a280
add esp, 0x18
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push 0x4a0858
push edx
push eax
call fcn.00421a50
cmp eax, ebx
jne 0x41b821
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x218]
lea edx, [esp + 0x218]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push ecx
push 0x200
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x430]
add esp, 0x10
cmp eax, 1
jne 0x41b7d8
mov eax, dword [esi]
mov dword [esp + 0x218], eax
jmp 0x41b7e6
cmp eax, 2
jne 0x41b7e6
mov ecx, dword [esi]
mov dword [esp + 0x21c], ecx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x218]
push edx
push 0x200
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x40c
ret 0x10
mov eax, 0xe0600007
pop edi
pop esi
pop ebx
add esp, 0x40c
ret 0x10
Function at 0x41b8c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x210
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x218]
lea ecx, [esp + 0x10]
push eax
push 0x104
push ecx
call fcn.0041a5e0
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 4], eax
jne 0x41b925
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
add esp, 0x210
ret 0xc
push esi
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41b948
mov edi, 0xe0600002
pop esi
mov eax, edi
pop edi
add esp, 0x210
ret 0xc
mov ecx, dword [esp + 8]
push esi
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x41b969
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b9f6
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x49e054
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x41b989
mov edi, 0xe0600007
jmp 0x41b9f8
mov eax, dword [esp + 0xc]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
push str._d._d._d._d
lea ecx, [esp + 0x12c]
push 0x100
push ecx
call fcn.0041a5e0
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x224]
mov eax, dword [esp + 0x220]
not ecx
dec ecx
push edx
push eax
mov dword [esp + 0x10], ecx
push ecx
lea ecx, [esp + 0x124]
push ecx
call fcn.00419ec0
mov edi, eax
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, edi
pop esi
pop edi
add esp, 0x210
ret 0xc

Function at 0x41bae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor esi, esi
test edi, edi
jle 0x41bb68
push ebp
mov ebp, dword [esp + 0x18]
jmp 0x41bb05
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
inc cl
and ecx, 0xff
mov edi, ecx
mov dword [esp + 0xc], edi
mov ecx, dword [eax + edi*4 + 8]
mov dword [esp + 0x18], ecx
add cl, dl
mov edx, dword [esp + 0x18]
and ecx, 0xff
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + ecx*4 + 8]
mov dword [eax + edi*4 + 8], ecx
mov edi, dword [esp + 0x14]
add cl, dl
and ecx, 0xff
mov dword [eax + edi*4 + 8], edx
mov dl, byte [esi + ebp]
mov cl, byte [eax + ecx*4 + 8]
xor dl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + ebp], dl
inc esi
cmp esi, ecx
jl 0x41bafd
mov edx, dword [esp + 0xc]
mov ecx, edi
pop ebp
pop edi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop esi
pop ecx
ret
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
pop ecx
ret
Function at 0x41fb50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x47e0f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [eax]
push esi
mov esi, dword [esp + 0x38]
mov dword [ebx], ecx
push edi
lea ebp, [ebx + 0x14]
mov edx, dword [esi]
lea edi, [esi + 0x10]
mov dword [ebx + 4], edx
mov eax, dword [esi + 4]
mov dword [ebx + 8], eax
mov ecx, dword [esi + 8]
mov dword [ebx + 0xc], ecx
mov edx, dword [esi + 0xc]
lea eax, [esp + 0x38]
mov ecx, edi
push eax
mov dword [ebx + 0x10], edx
mov dword [esp + 0x28], ebp
call fcn.00420030
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x10], ebp
mov dword [ecx], ebp
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
mov edi, edx
mov dword [esp + 0x1c], edx
sub edi, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
lea edx, [edi + 1]
cmp edx, 0xffffffff
mov dword [esp + 0x14], edx
ja 0x41fc6b
test edx, edx
jbe 0x41fc6b
cmp edx, 0x10
jbe 0x41fc0d
lea eax, [esp + 0x13]
push eax
lea eax, [esp + 0x18]
push eax
push edx
call fcn.0041fc80
mov ecx, dword [esp + 0x14]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], eax
add eax, ecx
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp + 0x14]
cmp ecx, eax
jne 0x41fc1c
mov eax, edx
jmp 0x41fc3c
mov ecx, edi
mov edi, edx
mov edx, ecx
mov esi, eax
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x3c]
add eax, ecx
mov dword [ebp + 0x10], eax
mov byte [eax], 0
mov eax, dword [esi + 0x2c]
pop edi
mov dword [ebx + 0x30], eax
mov ecx, dword [esi + 0x30]
mov dword [ebx + 0x34], ecx
mov edx, dword [esi + 0x34]
mov ecx, dword [esp + 0x24]
pop esi
mov dword [ebx + 0x38], edx
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
push str.basic_string
call fcn.00476710
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x420360
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x47e138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov ebx, ecx
push edi
mov eax, dword [esi]
lea edi, [esi + 0x10]
mov dword [ebx], eax
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [esi + 8]
lea ecx, [esp + 0x12]
mov dword [ebx + 8], edx
mov eax, dword [esi + 0xc]
lea ebp, [ebx + 0x10]
push ecx
mov ecx, edi
mov dword [ebx + 0xc], eax
mov dword [esp + 0x28], ebp
call fcn.00420030
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x10], ebp
mov dword [ecx], ebp
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
mov edi, edx
mov dword [esp + 0x1c], edx
sub edi, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
lea edx, [edi + 1]
cmp edx, 0xffffffff
mov dword [esp + 0x14], edx
ja 0x420472
test edx, edx
jbe 0x420472
cmp edx, 0x10
jbe 0x420414
lea eax, [esp + 0x13]
push eax
lea eax, [esp + 0x18]
push eax
push edx
call fcn.0041fc80
mov ecx, dword [esp + 0x14]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], eax
add eax, ecx
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp + 0x14]
cmp ecx, eax
jne 0x420423
mov eax, edx
jmp 0x420443
mov ecx, edi
mov edi, edx
mov edx, ecx
mov esi, eax
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
add eax, ecx
mov dword [ebp + 0x10], eax
mov byte [eax], 0
mov eax, dword [esi + 0x2c]
pop edi
mov dword [ebx + 0x2c], eax
mov ecx, dword [esi + 0x30]
mov dword [ebx + 0x30], ecx
mov edx, dword [esi + 0x34]
mov ecx, dword [esp + 0x24]
pop esi
mov dword [ebx + 0x34], edx
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
push str.basic_string
call fcn.00476710
nop
nop
nop
nop