joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cb10
Capabilities:
Read file via mapping

Disassembly:
mov eax, 0x3020
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x301c], eax
push ebp
push str.winrar_config_integration
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebp, eax
test ebp, ebp
je 0x40cc5f
push ebx
push 0x10000
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x40cb79
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
mov ecx, dword [esp + 0x301c]
xor ecx, esp
call fcn.004f833c
add esp, 0x3020
ret
cmp byte [ebx], 0x49
push esi
mov esi, ebx
jne 0x40cbf1
movzx ecx, byte [ebx + 2]
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
cmp ecx, 0x1a
jne 0x40cbf1
push edi
lea esi, [ebx + 3]
mov ecx, 6
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [esp + 0x1030]
push eax
lea eax, [ebx + 0x1d]
movsw word es:[edi], word [esi]
push eax
call fcn.0040cc80
push 0x400
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.0040cc80
mov esi, eax
pop edi
test esi, esi
je 0x40cbf1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call fcn.0043bf80
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x102c]
push eax
call fcn.0040d1c0
cmp byte [esi], 0x54
jne 0x40cc4f
push 0x800
lea eax, [esp + 0x202c]
push eax
lea eax, [esi + 1]
push eax
call fcn.0040cc80
push 0x800
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.0040cc80
push 0x800
lea ecx, [esp + 0x102c]
push ecx
push eax
call fcn.0040cc80
test eax, eax
je 0x40cc4f
push 0
lea eax, [esp + 0x102c]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2034]
push eax
call fcn.0043b230
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov ecx, dword [esp + 0x3020]
pop ebp
xor ecx, esp
call fcn.004f833c
add esp, 0x3020
ret
Function at 0x40dd30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x98
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0x544d58], 0
je 0x40dd6d
xor eax, eax
cmp dword [0x544d4c], eax
setne al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.004f833c
add esp, 0x98
ret
push esi
push edi
push 0x90
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004fa860
add esp, 0xc
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0x18], 2
push str.USER32
sete al
mov dword [0x544d5c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40de4e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x518760
push esi
call edi
mov dword [0x544d3c], eax
test eax, eax
je 0x40de4e
push str.MonitorFromWindow
push esi
call edi
mov dword [0x544d40], eax
test eax, eax
je 0x40de4e
push str.MonitorFromRect
push esi
call edi
mov dword [0x544d44], eax
test eax, eax
je 0x40de4e
push str.MonitorFromPoint
push esi
call edi
mov dword [0x544d48], eax
test eax, eax
je 0x40de4e
push str.EnumDisplayMonitors
push esi
call edi
mov dword [0x544d50], eax
test eax, eax
je 0x40de4e
push str.EnumDisplayDevicesW
push esi
call edi
mov dword [0x544d54], eax
test eax, eax
je 0x40de4e
cmp dword [0x544d5c], 0
je 0x40de36
push str.GetMonitorInfoW
jmp 0x40de3b
push str.GetMonitorInfoA
push esi
call edi
mov dword [0x544d4c], eax
test eax, eax
je 0x40de4e
mov eax, 1
jmp 0x40de96
mov dword [0x544d3c], 0
xor eax, eax
mov dword [0x544d40], 0
mov dword [0x544d44], 0
mov dword [0x544d48], 0
mov dword [0x544d4c], 0
mov dword [0x544d50], 0
mov dword [0x544d54], 0
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
mov dword [0x544d58], 1
call fcn.004f833c
add esp, 0x98
ret
Function at 0x40ecf0
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ff61
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x544354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x54cb40], 0
jne 0x40eeaa
push str.WinRAR_DragDrop
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40ed74
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b9
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
push 8
mov byte [0x544d62], al
call fcn.004f80fc
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x40edaf
mov dword [esi], 0x51882c
mov dword [esi + 4], 1
jmp 0x40edb1
xor esi, esi
mov dword [ebp - 4], 0xffffffff
push 0xd750
call fcn.004f80fc
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x40ede4
push 0
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.0040dff0
jmp 0x40ede6
xor eax, eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
push ecx
push 3
push esi
push eax
mov dword [0x544d64], eax
mov byte [0x544d61], 0
mov byte [0x544d60], 1
mov byte [0x544d63], 0
call dword [sym.imp.ole32.dll_DoDragDrop]
mov ebx, eax
mov byte [0x544d60], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
cmp byte [0x544d62], 0
je 0x40ee59
cmp byte [0x54ba54], 0
je 0x40ee59
cmp ebx, 0x40100
jne 0x40ee59
call fcn.004d92d0
mov ecx, 0x570db0
call fcn.00445040
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x40100
je 0x40eeaa
cmp ebx, 0x40101
je 0x40eeaa
cmp byte [0x544d63], 0
jne 0x40eeaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x40eeaa
push 0x53c
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 4
mov ecx, 0x57f41c
call fcn.00466a60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40fb40
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov eax, 0x3008
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x3004], eax
push esi
mov esi, dword [esp + 0x3010]
call fcn.00470750
cmp eax, 0x600
jb 0x40fd2e
push esi
call fcn.004cc170
test al, al
jne 0x40fd2e
push 0x800
lea eax, [esp + 0xc]
mov ecx, 0x570db0
push eax
push esi
call fcn.004417b0
push 0x800
lea eax, [esp + 0x100c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0047cc90
lea eax, [esp + 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x40fd2e
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40fbf6
mov eax, dword [esp + 4]
and eax, 0x80008
cmp eax, 8
jne 0x40fd2e
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fc25
test al, 0x10
jne 0x40fc25
lea eax, [esp + 8]
push eax
call fcn.0040f990
and eax, 6
cmp al, 6
jne 0x40fc96
lea eax, [esp + 8]
push eax
call fcn.0047d890
push ebx
lea eax, [esp + 0xc]
xor bl, bl
push eax
call fcn.0046cad0
test al, al
jne 0x40fccb
mov bl, 1
lea esp, [esp]
push 0x800
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2014]
push eax
call fcn.004947d0
lea eax, [esp + 0xc]
push eax
call fcn.0047d890
lea eax, [esp + 0x200c]
lea ecx, [esp + 0xc]
lea esp, [esp]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40fcb0
test dx, dx
je 0x40fc92
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40fcb0
add ecx, 4
add eax, 4
test dx, dx
jne 0x40fc70
xor eax, eax
jmp 0x40fcb5
mov al, 1
pop esi
mov ecx, dword [esp + 0x3004]
xor ecx, esp
call fcn.004f833c
add esp, 0x3008
ret 8
sbb eax, eax
or eax, 1
test eax, eax
je 0x40fccb
lea eax, [esp + 0xc]
push eax
call fcn.0046cad0
test al, al
je 0x40fc40
lea eax, [esp + 0xc]
push eax
call fcn.0040f990
mov ecx, eax
shr eax, 2
shr ecx, 1
and cl, 1
test al, 1
je 0x40fd10
test bl, bl
je 0x40fcf1
cmp byte [esp + 0x3018], 0
je 0x40fcf5
test cl, cl
je 0x40fd10
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x3004]
xor ecx, esp
call fcn.004f833c
add esp, 0x3008
ret 8
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x3004]
xor ecx, esp
call fcn.004f833c
add esp, 0x3008
ret 8
mov ecx, dword [esp + 0x3008]
xor al, al
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x3008
ret 8
Function at 0x410e60
Capabilities:
Delete file
Log keystrokes via polling

Disassembly:
mov eax, 0x2050
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x204c], eax
push esi
push 0
mov esi, ecx
push 9
push 0x110a
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x410f8e
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x113e
push dword [esi]
mov dword [esp + 0x34], 4
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x410f8e
mov eax, dword [esp + 0x48]
test eax, eax
je 0x410f8e
lea ecx, [esp + 0x4c]
push ecx
push dword [eax + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x410f8e
push ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
lea eax, [esp + 0x50]
push 0x800
shr ebx, 0xf
push eax
lea eax, [esp + 0x1058]
not bl
push eax
and bl, 1
call fcn.004947d0
lea ecx, [esp + 0x1050]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410f13
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1002
jae 0x410fa4
xor eax, eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x18], eax
mov word [esp + ecx + 0x1050], ax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x40
mov word [esp + 0x18], ax
lea eax, [esp + 0x1050]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
movzx eax, byte [esi + 8]
mov ecx, esi
push eax
call fcn.00412a10
pop ebx
mov ecx, dword [esp + 0x2050]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x2050
ret
call fcn.004f8260
int3
Function at 0x4117a0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
mov ebx, dword [esp + 0x2c4]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x2c4]
push 0x4009
push 0x2b4
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0xc]
push 0x400b
push 0x2b4
mov dword [ebx + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2bc]
pop edi
mov dword [ebx + 0x1c], eax
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2b8
ret 8
Function at 0x4127b0
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x12b8
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x12b4], eax
mov eax, dword [esp + 0x12bc]
push esi
mov esi, ecx
push 0x4001
push 0x2b4
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x517c80
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x412826
push eax
push 0x800
lea eax, [esp + 0x2c0]
push eax
call fcn.004cbf30
push 0x4001
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x2c8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 0
push 0x1109
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x12b8]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x12b8
ret 4

Function at 0x413d20
Capabilities:
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
lea edi, [esi + 0x103a]
mov byte [esi + 0x38], 0
mov word [edi], ax
lea eax, [esp + 0xb]
mov edx, dword [esi + 4]
push eax
lea eax, [edx + 0x5028]
push eax
lea eax, [edx + 0xb552]
push eax
call fcn.00413da0
test al, al
jne 0x413d70
cmp byte [esp + 0xb], al
jne 0x413d97
mov eax, dword [esi + 4]
mov ecx, 0x57f41c
add eax, 0xb552
push eax
call fcn.004667d0
pop edi
pop esi
pop ecx
ret
mov eax, dword [esi + 8]
mov ecx, esi
push dword [eax + 4]
call fcn.004139e0
mov ecx, esi
call fcn.00413520
cmp byte [esi + 0x38], 0
je 0x413d97
cmp word [edi], 0
je 0x413d97
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ecx
ret

Function at 0x413f70
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x413fb8
mov edx, dword [esp + 0x10]
push ebx
xor ebx, ebx
mov dword [edx], 0
mov dword [edx + 4], 0
cmp dword [edi + 0x18], ebx
jbe 0x413faf
xor esi, esi
mov ecx, dword [edi + 0x14]
lea esi, [esi + 0x10]
mov eax, dword [ecx + esi - 8]
add dword [edx], eax
mov eax, dword [ecx + esi - 4]
adc dword [edx + 4], eax
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x413f96
pop ebx
pop edi
mov al, 1
pop esi
pop ecx
ret 4
lea eax, [esp + 8]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413fdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413fdf
pop edi
xor al, al
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [esp + 8]
add ecx, esi
pop edi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x415513
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x415600
mov ecx, dword [esi + 0x18]
push edi
xor edi, edi
test ecx, ecx
je 0x41553c
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x14]
cmp edx, dword [eax]
je 0x41553c
inc edi
add eax, 0x10
cmp edi, ecx
jb 0x415530
cmp edi, ecx
jb 0x41554a
pop edi
xor al, al
pop esi
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 8], ecx
mov ecx, edi
push ebx
mov ebx, dword [esp + 0x24]
shl ecx, 4
push ebp
mov ebp, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], edx
lea esp, [esp]
test ebx, ebx
je 0x4155de
mov eax, dword [esi + 0x14]
mov eax, dword [ecx + eax]
mov dword [esi + 8], eax
mov byte [esi + 0x10], 0
cmp ebp, edi
jbe 0x41559b
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push 0
push 0
push 0
call fcn.00415860
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push ebx
push edx
mov ecx, esi
call fcn.00415510
mov byte [esi + 0x10], 1
test al, al
je 0x4155f4
mov eax, dword [esp + 0x24]
inc ebp
mov edx, dword [esp + 0x28]
sub ebx, eax
mov ecx, dword [esp + 0x14]
add edx, eax
add dword [esp + 0x10], eax
add ecx, 0x10
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esi + 0x18]
jb 0x415570
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
mov dword [eax], ecx
mov al, 1
pop esi
add esp, 0x10
ret 0xc
pop ebp
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x10
ret 0xc
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop esi
setne al
add esp, 0x10
ret 0xc

Function at 0x415e42
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x18]
add dword [esi + 0x20], edi
mov ecx, dword [esi + 0x20]
adc dword [esi + 0x24], 0
mov edx, dword [esi + 0x24]
jne 0x415e5d
test ecx, ecx
je 0x415e9c
mov ebp, dword [esi + 0x2c]
mov ebx, dword [esi + 0x28]
cmp edx, ebp
ja 0x415e9c
jb 0x415e6d
cmp ecx, ebx
jae 0x415e9c
mov eax, dword [esi + 0xc]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov byte [eax + 0x30], 1
cmp byte [esi + 5], 0
mov bl, 1
mov ebp, dword [esp + 0x14]
je 0x415eb0
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
jmp 0x415ec6
push 0
push dword [esp + 0x20]
push edi
push ebp
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov ecx, dword [esi + 0xc]
push edi
push ebp
push dword [ecx + 4]
call fcn.0041b140
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc
Function at 0x418ad0
Capabilities:
Hash data using crc32b

Disassembly:
xor ecx, ecx
mov eax, ecx
shl eax, 0x18
test eax, eax
jns 0x418ae4
add eax, eax
xor eax, 0x4c11db7
jmp 0x418ae6
add eax, eax
test eax, eax
jns 0x418af3
add eax, eax
xor eax, 0x4c11db7
jmp 0x418af5
add eax, eax
test eax, eax
jns 0x418b02
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b04
add eax, eax
test eax, eax
jns 0x418b11
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b13
add eax, eax
test eax, eax
jns 0x418b20
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b22
add eax, eax
test eax, eax
jns 0x418b2f
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b31
add eax, eax
test eax, eax
jns 0x418b3e
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b40
add eax, eax
test eax, eax
jns 0x418b4d
add eax, eax
xor eax, 0x4c11db7
jmp 0x418b4f
add eax, eax
mov dword [ecx*4 + 0x545d80], eax
inc ecx
cmp ecx, 0x100
jl 0x418ad2
ret

Function at 0x41af70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.0047d830
push edi
push dword [esp + 0x14]
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.00494790
push esi
call fcn.0046cad0
test al, al
je 0x41afad
pop edi
mov al, 1
pop esi
pop ecx
ret 0xc
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0x518f20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41aff9
lea eax, [edi + edi]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x10]
push eax
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0047d830
push edi
push dword [esp + 0x14]
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.00494790
push esi
call fcn.0046cad0
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x41b780
Capabilities:
Check if file exists

Disassembly:
mov dword [ecx + 0x102c], 0
mov dword [ecx + 0x1028], 0
jmp fcn.0046b720
Function at 0x422a50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x422a94
push esi
mov esi, dword [esp + 0x10]
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor eax, esi
shrd esi, edx, 8
movzx ecx, al
shr edx, 8
xor esi, dword [ecx*8 + 0x54a1b0]
xor edx, dword [ecx*8 + 0x54a1b4]
sub edi, 1
jne 0x422a67
mov eax, esi
pop esi
pop edi
pop ebx
ret 0x10
mov eax, dword [esp + 0xc]
pop edi
pop ebx
ret 0x10
Function at 0x4275a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
test esi, esi
je 0x4275df
movzx eax, word [edx + 0x851c]
push edi
mov edi, dword [esp + 0xc]
movsx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [edx + ecx*2 + 8]
movzx eax, ax
mov word [edx + 0x851c], ax
sub esi, 1
jne 0x4275b7
pop edi
pop esi
ret 8
mov ax, word [edx + 0x851c]
pop esi
ret 8

Function at 0x4275f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510d88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x544354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
lea ecx, [ebp - 0x28]
push 0x800
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], al
call fcn.004087e0
mov dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [ebp + 0x10]
mov word [esi + 0x851c], ax
mov esi, dword [ebp - 0x28]
test ebx, ebx
jle 0x42770d
lea esp, [esp]
mov eax, 0x800
cmp ebx, 0x800
ja 0x427670
movzx eax, bx
mov ecx, dword [ebp + 8]
movzx edi, ax
push edi
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, edi
jne 0x4276f2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
call eax
test al, al
je 0x427699
mov ecx, dword [ebp + 0xc]
push edi
push esi
call fcn.0046bda0
cmp dword [ebp + 0x14], 0
je 0x4276db
mov edx, edi
test edx, edx
je 0x4276d8
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
movzx eax, word [eax + 0x851c]
movsx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [ebx + ecx*2 + 8]
movzx eax, ax
mov word [ebx + 0x851c], ax
sub edx, 1
jne 0x4276b2
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
sub ebx, edi
add eax, edi
mov dword [ebp + 0x10], ebx
mov dword [ebp - 0x10], eax
test ebx, ebx
jg 0x427660
jmp 0x42770f
mov eax, dword [ebp - 0x14]
mov ecx, 0x57f41c
mov eax, dword [eax + 4]
add eax, 0xb552
push eax
call fcn.004664c0
mov eax, dword [ebp - 0x10]
jmp 0x42770f
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x427735
cmp byte [ebp - 0x18], 0
je 0x427729
push dword [ebp - 0x20]
push esi
call fcn.00491e00
push esi
call fcn.004fe8b9
mov eax, dword [ebp - 0x10]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42e5f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, ecx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x42e608
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x1c]
add eax, 0xfffffff0
cmp esi, eax
jb 0x42e619
mov esi, eax
mov edi, dword [edi + 4]
xor edx, edx
add edi, 0x10
test esi, esi
je 0x42e644
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, edx
shl edx, 8
shr ecx, 8
xor ecx, eax
movzx eax, cl
xor edx, dword [ebx + eax*4 + 0x1a90]
sub esi, 1
jne 0x42e625
pop edi
movzx eax, dx
cmp eax, dword [ebp + 0x10]
pop esi
pop ebp
sete al
pop ebx
ret 8

Function at 0x437ef0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea edi, [eax + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f847f
add esp, 4
mov esi, eax
push edi
push esi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [0x5764b8]
push esi
call fcn.004ad290
push esi
call fcn.004cb4c0
push esi
call fcn.004f8488
add esp, 4
pop edi
pop esi
ret 4