joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413d56
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 8], ebx
jne 0x413d68
xor eax, eax
jmp 0x413dd6
push edi
lea eax, [esi + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea edi, [esi + 0x28]
call fcn.00413f8d
lea eax, [esi + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
cmp dword [esi + 0x1d4], ebx
jne 0x413db6
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x413edc
push ebx
push ebx
mov dword [ebp + 8], ebx
call fcn.00477f45
add esp, 0x18
mov dword [esi + 0x1d4], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x413dd3
push ebx
push ebx
push 0x720
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41403a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00476cc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00401aaf
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00476d3a
leave
ret

Function at 0x414206
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41422e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x414276
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x414221
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x414257
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x414275
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 0x10]
call fcn.00403278
add esp, 0xc
pop edi
pop esi
pop ebp
ret

Function at 0x414279
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4142a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x4142e8
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x414293
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4142c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x4142e7
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 0x10]
call fcn.00403278
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x414c61
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
je 0x414c93
lea eax, [ebp + 8]
push eax
push edi
add esi, 0xffffffdc
push esi
push 0x414f03
push edi
push edi
mov dword [ebp + 8], edi
call fcn.00477f45
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414cac
lea eax, [esi - 0x24]
call fcn.004159fd
push 0x64
push edi
push 0x65a
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x414fdb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
mov eax, dword [0x4c3a60]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push edi
xor edi, edi
push edi
push 0x1f4
mov ebx, ecx
push 0x64
mov dword [esi + 0xe4], edi
push dword [ebx + 4]
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
push 0x206
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push edi
push eax
call fcn.00476cc0
add esp, 0xc
cmp dword [esi + 0x154], 8
jb 0x415041
mov ecx, dword [esi + 0x140]
jmp 0x415047
lea ecx, [esi + 0x140]
cmp dword [esi + 0x138], 8
jb 0x415058
mov eax, dword [esi + 0x124]
jmp 0x41505e
lea eax, [esi + 0x124]
push ecx
push eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
cmp dword [esi + 0xfc], edi
je 0x4150d0
cmp dword [esi + 0x154], 8
jb 0x415092
mov ecx, dword [esi + 0x140]
jmp 0x415098
lea ecx, [esi + 0x140]
cmp dword [esi + 0x138], 8
jb 0x4150a9
mov edx, dword [esi + 0x124]
jmp 0x4150af
lea edx, [esi + 0x124]
lea eax, [esi + 0xe8]
cmp dword [eax + 0x18], 8
jb 0x4150c0
mov eax, dword [eax + 4]
jmp 0x4150c3
add eax, 4
push ecx
push eax
mov ecx, esi
call fcn.004154eb
cmp eax, edi
je 0x41512a
cmp dword [esi + 0x118], edi
je 0x415126
cmp dword [esi + 0x154], 8
jb 0x4150e9
mov ebx, dword [esi + 0x140]
jmp 0x4150ef
lea ebx, [esi + 0x140]
cmp dword [esi + 0x138], 8
jb 0x415100
mov edx, dword [esi + 0x124]
jmp 0x415106
lea edx, [esi + 0x124]
lea eax, [esi + 0x104]
cmp dword [eax + 0x18], 8
jb 0x415117
mov eax, dword [eax + 4]
jmp 0x41511a
add eax, 4
push eax
mov ecx, esi
call fcn.004153c6
mov ebx, dword [esp + 0xc]
cmp eax, edi
jne 0x415192
mov eax, dword [esi + 0xdc]
cmp eax, 1
je 0x415139
cmp eax, edi
jne 0x415148
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x16c]
mov dword [esi + 0x164], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call fcn.0040cb60
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [esp + 0x20]
call fcn.0040ec21
lea ecx, [esp + 0x14]
call fcn.0040ec21
xor eax, eax
jmp 0x4151b9
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, esi
call fcn.004159fd
push 0x64
push 1
push 0x65a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x254]
pop edi
pop ebx
xor ecx, esp
call fcn.00476d3a
mov esp, ebp
pop ebp
ret
Function at 0x41600e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x4c3a60]
xor eax, esp
mov dword [esp + 0x138], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, edx
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x4161aa
cmp ebx, edi
je 0x4161aa
cmp ecx, edi
je 0x4161aa
push ebx
mov dword [esi + 8], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41606f
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 1
call dword [eax]
xor eax, eax
jmp 0x4161ad
push 0x4b3140
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x41608c
mov esi, dword [esi + 8]
mov eax, dword [esi]
push edi
mov ecx, esi
jmp 0x416066
lea eax, [esp + 0x58]
push eax
push ebx
call fcn.0047c038
pop ecx
pop ecx
test eax, eax
jne 0x416082
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.0047bccd
pop ecx
pop ecx
test eax, eax
jne 0x416082
lea eax, [esp + 0x18]
push eax
call fcn.0047a439
pop ecx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0047a15a
pop ecx
pop ecx
test eax, eax
jne 0x416082
cmp dword [esi + 4], edi
jne 0x416122
push 0x58
call fcn.00476d64
pop ecx
cmp eax, edi
je 0x416102
mov ecx, eax
call fcn.0042964f
jmp 0x416104
xor eax, eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [esi + 4]
push eax
call fcn.004296d7
mov eax, dword [esi + 4]
mov dword [eax + 0x28], esi
mov eax, dword [esi + 4]
mov dword [eax + 0x3c], edi
push 0x70
lea eax, [esp + 0xd4]
push edi
push eax
call fcn.00476cc0
add esp, 0xc
lea eax, [esp + 0x88]
push eax
push 0x4b40e4
lea eax, [esp + 0xd8]
push 0x38
push eax
call fcn.0047c623
add esp, 0x10
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x24]
call fcn.004018f6
push dword [esp + 0xc]
lea ecx, [esp + 0x40]
call fcn.004018f6
lea eax, [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.004163c5
mov ebx, eax
neg ebx
push edi
sbb bl, bl
push 1
lea ecx, [esp + 0x44]
inc bl
call fcn.00401ad3
push edi
push 1
lea ecx, [esp + 0x28]
call fcn.00401ad3
xor eax, eax
test bl, bl
setne al
jmp 0x4161ad
xor eax, eax
inc eax
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00476d3a
mov esp, ebp
pop ebp
ret 8
Function at 0x416263
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push 7
pop esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov edi, ecx
push 0
lea ecx, [ebp - 0x3c]
mov ebx, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], esi
call fcn.00401d5a
push 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], esi
call fcn.00401d5a
push ebx
lea ebx, [ebp - 0x3c]
mov eax, edi
call fcn.004161c4
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4162c0
lea eax, [ebp - 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4162c3
mov ecx, dword [ebp - 0x38]
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x24], 8
jae 0x4162dd
lea ecx, [ebp - 0x38]
mov ebx, dword [ebp - 0x48]
push ebx
push eax
push ecx
call fcn.0040b780
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x4162f6
mov edi, dword [edi + 4]
jmp 0x4162f9
add edi, 4
push esi
push str.http:__
push edi
call fcn.0047c72a
add esp, 0xc
test eax, eax
jne 0x41630f
add edi, 0xe
mov esi, 0x4b4128
push esi
push edi
call fcn.00479d55
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
test eax, eax
jne 0x416327
push esi
jmp 0x416328
push eax
call fcn.00401aaf
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x416339
lea eax, [ebp - 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x41633c
mov ecx, dword [ebp - 0x1c]
sub eax, edx
sar eax, 1
cmp dword [ebp - 8], 8
jae 0x416356
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x44]
push eax
push ecx
call fcn.0040b780
add esp, 0xc
cmp dword [ebx + 0x18], 0x10
lea esi, [ebx + 4]
jb 0x416370
mov eax, dword [esi]
jmp 0x416372
mov eax, esi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x41638e
cmp dword [ebx + 0x18], 0x10
jb 0x416385
mov esi, dword [esi]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x416395
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x40]
push 0
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x20]
call fcn.00401ad3
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401ad3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00476d3a
leave
ret 0xc
Function at 0x41881d
Capabilities:
Set current directory

Disassembly:
push ebx
push edi
push 0x4d1af8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [esi + 0x60]
mov eax, dword [esi + 0x60]
xor ebx, ebx
cmp eax, ebx
jle 0x41884b
xor ebx, ebx
inc ebx
push 0x4d1af8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebx
pop ebx
ret 4
cmp dword [esi + 0x58], ebx
je 0x418839
lea edi, [esi + 0x3c]
cmp dword [edi + 0x18], 8
jb 0x41885e
mov eax, dword [edi + 4]
jmp 0x418861
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, edi
call fcn.0040390a
push dword [esp + 0xc]
mov eax, esi
call fcn.004187bb
test eax, eax
jne 0x418839
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x418839
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x58], ebx
jmp 0x418836

Function at 0x41a6d4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3c4]
push 0x4d0bc4
mov ecx, edi
mov dword [ebp - 0x64], edi
call fcn.0041a220
lea eax, [ebp + 0x1b0]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41a731
lea eax, [ebp + 0x1b0]
push eax
push edi
call fcn.0041c1db
push edi
call fcn.0041a9e8
mov ebx, fcn.0041a6d4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41a7d4
push 0x1c
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push esi
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41a7d4
lea eax, [ebp - 0x58]
push eax
lea esi, [ebp - 0x60]
call fcn.0041c0d9
mov ebx, dword [ebp - 0x60]
push 0x5c
push ebx
call fcn.0047c847
pop ecx
pop ecx
test eax, eax
je 0x41a7cc
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x41a7cc
lea edi, [eax + 1]
test edi, edi
jge 0x41a793
xor edi, edi
cmp edi, dword [ebx - 0xc]
lea eax, [ebp - 0x60]
jl 0x41a7a6
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041bf05
jmp 0x41a7b6
call fcn.0041ad39
push ebx
mov ecx, eax
lea esi, [ebp - 0x5c]
call fcn.0041ace7
mov edi, dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
call fcn.0041a9a5
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.0041a245
lea ecx, [ebx - 0x10]
call fcn.0041a245
mov ecx, dword [ebp + 0x3b8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476d3a
add ebp, 0x3bc
leave
ret
Function at 0x41bf23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41bf3a
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41bf6f
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x41bf6b
cmp edi, eax
jae 0x41bf6f
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x41bf5d
cmp edi, eax
jb 0x41bf73
xor eax, eax
jmp 0x41bf7c
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x41c7e7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x850
mov eax, dword [0x4c3a60]
xor eax, esp
mov dword [esp + 0x84c], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x18]
lea eax, [esi + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
test edi, edi
je 0x41c910
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x41c910
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x38]
call fcn.0041d10f
mov eax, esi
mov ecx, ebx
call fcn.0041c924
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
call fcn.00476cc0
add esp, 0xc
push 0x401
lea eax, [esp + 0x54]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x10]
call fcn.0041c0d9
mov edi, dword [ebx + 0x5c]
add edi, 0x48
mov eax, esi
call fcn.0041a9a5
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.0041a245
mov eax, ebx
call fcn.0041c973
mov ecx, dword [ebx + 0x5c]
push dword [esp + 0x30]
mov esi, ebx
mov dword [ecx + 0x4c], eax
call fcn.00420f38
push dword [esp + 0x30]
lea eax, [esp + 0x14]
push dword [ebx + 0x5c]
call fcn.00422cec
cmp dword [ebx + 0x30], 0
je 0x41c907
mov eax, dword [esp + 0x10]
add eax, 2
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add eax, 2
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffffe
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffe
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [esp + 0x30]
call fcn.0041d08d
mov ecx, dword [esp + 0x854]
pop edi
pop esi
xor ecx, esp
call fcn.00476d3a
mov esp, ebp
pop ebp
ret
Function at 0x424039
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ecx, ecx
push esi
mov esi, dword [eax*4 + 0x4d1aa0]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jne 0x424061
mov eax, 0x86180002
jmp 0x424175
mov eax, dword [ebp + 0xc]
cmp eax, ecx
je 0x42406a
mov dword [eax], ecx
lea eax, [esi + 0x4094]
push edi
mov edi, dword [eax]
cmp edi, dword [esi + 0x405c]
jae 0x424172
lea edx, [edi + 1]
mov dword [eax], edx
mov dword [esi + edi*4 + 0x40a4], ecx
mov ecx, dword [esi + 0x70a4]
mov ebx, edi
lea ecx, [esi + ecx*2 + 0x60a4]
shl ebx, 5
add ebx, dword [esi + 0x4050]
lea eax, [esi + 0x4040]
push ecx
mov edx, edi
call fcn.00425e91
mov eax, dword [ebp + 0xc]
pop ecx
test eax, eax
je 0x4240c1
lea ecx, [esi + 0x60a4]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x424172
cmp byte [ebx + 0x19], 0
jne 0x42411d
push 0x4c58a8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x40a0]
push eax
lea eax, [esi + 0x409c]
push eax
lea eax, [esi + 0x4098]
push eax
lea eax, [esi + 0x24]
push edi
push eax
lea eax, [esi + 0x4040]
call fcn.004268a2
add esp, 0x20
test eax, eax
je 0x42411d
xor ecx, ecx
cmp eax, 2
setne cl
lea ecx, [ecx + ecx - 0x79e7fffd]
mov eax, ecx
jmp 0x424174
mov eax, dword [esi + 0x70a4]
lea edi, [esi + eax*2 + 0x60a4]
cmp word [edi], 0
je 0x42415f
mov dword [ebp + 8], edi
cmp word [edi], 0x2f
jne 0x424151
xor eax, eax
mov word [edi], ax
lea eax, [esi + 0x60a4]
push eax
call fcn.00424ac7
pop ecx
push 0x5c
pop eax
mov word [edi], ax
mov edi, dword [ebp + 8]
inc edi
inc edi
cmp word [edi], 0
mov dword [ebp + 8], edi
jne 0x424133
cmp byte [ebx + 0x19], 0
je 0x424179
add esi, 0x60a4
push esi
call fcn.00424ac7
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [esi + 0x60a4]
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
push eax
xor eax, eax
inc eax
call fcn.00424ae0
pop ecx
pop ecx
test eax, eax
jne 0x4241d8
mov eax, dword [esi + 0x409c]
add eax, dword [ebp - 8]
mov edi, dword [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 4]
call fcn.00424b95
pop ecx
pop ecx
test eax, eax
jne 0x4241d8
cmp edi, dword [ebp - 4]
jne 0x4241d8
lea esi, [ebp + 8]
call fcn.00424b22
test eax, eax
jne 0x4241d8
cmp byte [ebx + 0x1d], al
je 0x424172
push dword [ebx + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x424172
mov eax, 0x86180003
jmp 0x424174
Function at 0x4246a3
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x4c3a60]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
mov eax, dword [ebp + 0x3b4]
push esi
push edi
mov dword [ebp - 0x4c], eax
xor eax, eax
xor esi, esi
push 0x3e6
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push esi
push eax
mov dword [ebp - 0x44], esi
call fcn.00476cc0
push 0x30
lea eax, [ebp - 0x7c]
push esi
push eax
lea edi, [ebp - 0x40]
mov dword [ebp - 0x80], esi
call fcn.00476cc0
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x42470f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x424767
lea eax, [ebp - 0x40]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x424767
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x48]
push eax
push esi
push esi
push edi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x424742
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x64]
je 0x424751
add edi, 8
lea eax, [ebp + 0x3a8]
cmp edi, eax
jb 0x424722
jmp 0x424767
push 0x104
push edi
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x44], 1
mov ecx, dword [ebp + 0x3a8]
mov eax, dword [ebp - 0x44]
pop edi
xor ecx, ebp
pop esi
call fcn.00476d3a
add ebp, 0x3ac
leave
ret
Function at 0x424b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x424b88
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x424b59
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x424b8d
test ecx, ecx
je 0x424b88
test edi, edi
ja 0x424b4e
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x424b8a

Function at 0x424b95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x424bdd
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x424bae
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x424be2
test ecx, ecx
je 0x424bdd
test edi, edi
ja 0x424ba3
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x424bdf

Function at 0x426bc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x426bc8
mov dword [ecx*4 + 0x4d3740], eax
inc ecx
cmp ecx, 0x100
jb 0x426bc3
mov edx, 0x800
jmp 0x426c15
mov eax, dword [ecx*4 + 0x4d3340]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4d3740]
inc ecx
mov dword [ecx*4 + 0x4d373c], eax
cmp ecx, edx
jb 0x426bf4
mov dword [0x4d1a8c], 0x42745f
call fcn.004275bd
test eax, eax
jne 0x426c36
mov dword [0x4d1a8c], 0x4274fb
pop esi
ret
Function at 0x4279c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4279dc
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x4279fb
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x427a00
inc edi
cmp edi, dword [ebp - 8]
jb 0x4279f2
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x427aef
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x427a82
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x427a2c
cmp cl, 0xff
jne 0x427ab1
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x427ac2
movzx esi, byte [edx + 0x4b4bc8]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x427a72
cmp bl, 0xff
jne 0x427abf
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x427a4a
dec ecx
shl edx, cl
and edx, 7
je 0x427a19
movzx ecx, byte [edx + 0x4b4bc8]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4b4bc0], 0
mov cl, byte [ebx + 4]
je 0x427aae
test cl, cl
je 0x427aae
cmp cl, 0xff
jne 0x427a19
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4279ed
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4279ed
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret