joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4617b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00423e00
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x426259
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.00421170
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.00421160
mov edx, dword [esp + 0x74]
mov ecx, esi
add eax, edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.004258b0
mov ebp, dword [eax]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x24], ecx
call dword [0x4634ec]
push 0
lea ecx, [esp + 0x4c]
call fcn.0045b8c7
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.004350c0
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.00423860
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x463158]
mov ecx, ebx
call fcn.004210e0
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x426324
push edi
mov ecx, esi
call fcn.00423970
push eax
push ebp
mov ecx, esi
call fcn.00423b30
cmp eax, dword [esp + 0x40]
jg 0x426320
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x4262fe
mov eax, ebx
jmp 0x42632a
cmp edi, ebx
jl 0x426328
mov eax, ebx
jmp 0x42632a
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x42633b
mov dword [esp + 0x30], eax
jmp 0x426346
cmp edi, ebx
jl 0x426341
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.004210a0
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x42638d
push edi
mov ecx, esi
call fcn.00423890
push eax
push ebx
mov ecx, esi
call fcn.00423c60
cmp eax, dword [esp + 0x44]
jg 0x426385
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x42635f
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x426397
cmp edi, ebp
jl 0x426391
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x426397
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x4263a0
mov ecx, eax
jmp 0x4263a9
cmp edi, ebp
jl 0x4263a6
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.00423880
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], 0xffffffff
call fcn.0045b939
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x435720
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x462298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x4634ec]
push 0
lea ecx, [esp + 0x20]
call fcn.0045b8c7
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.004350c0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0045b7f5
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004580ef
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004580ef
push 1
push 0
push 0
mov ecx, esi
call fcn.00458097
push 1
push 0
push 1
mov ecx, esi
call fcn.00458097
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045b939
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4358a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4622b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0045b8c7
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.004350c0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0045b7f5
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x4634ec]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x435964
cmp dword [esp + 0x40], 1
jne 0x435962
cmp ecx, eax
jge 0x435964
mov eax, ecx
cmp eax, 0xc8
jge 0x435970
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00435720
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x4634e8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045b939
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x4360f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x462323
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00456522
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x5fb6e0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x5fa758
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4630e0]
push eax
mov ecx, edi
call fcn.0045bb6f
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0045d08b
test eax, eax
je 0x43620c
mov ecx, dword [esp + 0x3c]
call fcn.0045bb9c
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4635c4]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4361d0
push edi
mov ecx, esi
call fcn.00459205
mov ecx, esi
call fcn.00436370
cmp dword [esp + 0x38], 1
jne 0x436205
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00459340
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x438c40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x438c73
push esi
call fcn.0043bd40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x438c6c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x438cf9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x438ce2
mov eax, dword [esi + 8]
test eax, eax
je 0x438c97
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x438cde
cmp eax, 2
je 0x438ce2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x438c8a
cmp eax, 3
je 0x438cbd
cmp eax, 1
jne 0x438c8a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x438c8a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x438c8a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00438d20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x438d08
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00438d20
add esp, 4
pop esi
ret
Function at 0x15061d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x1519cc4
call fcn.0150f958
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.01506304
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x150622f
lea ecx, [ebx + 0x400]
jmp 0x1506231
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.015015f4
mov word [ebp - 0x14], 0
jmp 0x1506277
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x150680c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0150667e
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x150684e
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.015066c8
test esi, esi
je 0x1506862
push dword [ebp + 0xc]
push edi
call fcn.0150f6b8
add esp, 8
xor eax, eax
jmp 0x1506864
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x150688c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.01502488
test eax, eax
je 0x15068ff
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0150667e
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.01502228
mov esi, 1
test ebx, ebx
je 0x15068f5
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.015066c8
test esi, esi
sete bl
and ebx, 1
jmp 0x1506937
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0150e1ac
pop ecx
mov esi, eax
push esi
push 0x1519cdc
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0150680c
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.01502228
push esi
call fcn.0150dfd4
pop ecx
test bl, bl
jne 0x1506945
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0150225c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1506950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0150667e
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x1506999
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.015066c8
test esi, esi
je 0x15069a6
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x15069a8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x15069fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0150667e
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x1506a3d
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.015066c8
test edi, edi
je 0x1506a6a
cmp dword [ebp + 0xc], 0
je 0x1506a58
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0150f4c8
add esp, 0xc
jmp 0x1506a66
push esi
push 0
push dword [ebp + 0x10]
call fcn.0150f538
add esp, 0xc
xor eax, eax
jmp 0x1506a6d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x15070a0
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.01507104
mov eax, esp
call fcn.01501bc8
push ebx
lea edx, [esp + 4]
push edx
call fcn.0150f5dc
add esp, 8
mov eax, esp
call fcn.01509618
test eax, eax
je 0x15070e8
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x15070ec
xor eax, eax
jmp 0x15070f8
push esp
push esi
call fcn.0150f6b8
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x1507104
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x1519e47
push esi
mov edx, str.TempFolder
mov eax, str.Paths
mov ecx, ebx
call fcn.015067f0
cmp byte [ebx], 0
je 0x1507131
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x150714f
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x1507141
cmp byte [ebx], 0
jne 0x150714f
push str._rartemp
push ebx
call fcn.0150f6b8
add esp, 8
mov eax, ebx
call fcn.01501bc8
pop esi
pop ebx
ret

Function at 0x1507364
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x1507387
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x1507398
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x15073a7
or dword [ebp - 8], 2
cmp byte [ebx + 0x15], 0
je 0x15073b1
xor eax, eax
jmp 0x15073b6
mov eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.01502488
test eax, eax
je 0x15073e3
test esi, esi
je 0x15073e3
cmp word [esi], 0
je 0x15073e3
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x15073fa
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x1507413
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x1507413
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1507481
mov dword [ebx + 4], edi
test esi, esi
je 0x1507448
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0150225c
jmp 0x1507451
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x1507468
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.0150f6b8
add esp, 8
jmp 0x1507477
lea edx, [ebx + 0x17]
mov ecx, 0x10000000
mov eax, esi
call fcn.01502204
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.015074b8
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1507674
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x150769b
cmp esi, 0x4e20
jle 0x1507691
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x15076ec
mov eax, ebx
call fcn.015078dc
test al, al
je 0x15076d3
cmp esi, 0x4e20
jle 0x15076d3
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.01507674
jmp 0x15076ef
cmp dword [ebx + 0xc], 1
jne 0x15076e7
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x15076e7
xor eax, eax
jmp 0x15076ef
or eax, 0xffffffff
jmp 0x15076ef
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x15094b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.01502488
test eax, eax
je 0x15094df
test ebx, ebx
je 0x15094df
cmp word [ebx], 0
je 0x15094df
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x1509b60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x151edf8
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x1509b7a
call fcn.01509b28
mov eax, ebp
jmp 0x1509b92
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x1509b9a
test al, 7
jne 0x1509b7e
cmp esi, 8
jb 0x1509c23
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x1509ba3
xor edx, edx
jmp 0x1509c3d
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x1509c27
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x150b69c
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x150bacc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [0x152022c]
mov eax, 0x15201fc
call fcn.01501870
mov edx, ebx
shl edx, 3
sub edx, ebx
add eax, edx
add eax, 0x400
push eax
call fcn.0150e1ac
pop ecx
mov ebx, eax
test ebx, ebx
je 0x150bb67
mov eax, esi
call fcn.0150b67c
push 1
push 0
mov cl, byte [ebp + 0xc]
mov edx, esi
mov eax, ebx
call fcn.0150d7ac
push 0x44
push 0
lea edx, [ebp - 0x44]
push edx
call fcn.0150f538
add esp, 0xc
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x44], 0x44
push ecx
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x150bb60
push dword [ebp - 0x50]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x54]
call sub.KERNEL32.DLL_CloseHandle
push ebx
call fcn.0150dfd4
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x150d1d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbfc
mov ebp, edx
mov ebx, eax
mov edi, dword [0x152022c]
mov eax, 0x15201fc
call fcn.01501860
mov eax, 0x15201fc
call fcn.015017e0
mov esi, eax
test ebp, ebp
je 0x150d211
push ebp
push ebx
call fcn.0150f6b8
add esp, 8
mov eax, ebx
call fcn.01501bc8
jmp 0x150d214
mov byte [ebx], 0
mov eax, esi
call fcn.01501a64
push eax
push ebx
call fcn.0150f5dc
add esp, 8
cmp edi, 1
mov byte [esp], 0
jle 0x150d2bd
push esi
lea edx, [esp + 8]
push edx
call fcn.0150f6b8
add esp, 8
cmp byte [0x151c7ac], 0
je 0x150d260
lea edx, [esp + 4]
mov eax, 0x151c6ac
mov ecx, 0x5c
call fcn.01502418
mov ebp, eax
jmp 0x150d271
push 0x5c
lea eax, [esp + 8]
push eax
call fcn.0150f78c
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x150d2bd
mov byte [ebp], 0
cmp byte [0x151c7ac], 0
je 0x150d299
lea edx, [esp + 4]
mov eax, 0x151c6ac
mov ecx, 0x5c
call fcn.01502418
mov ebp, eax
jmp 0x150d2aa
push 0x5c
lea eax, [esp + 8]
push eax
call fcn.0150f78c
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x150d2bd
inc ebp
push ebp
push ebx
call fcn.0150f6b8
add esp, 8
mov byte [esp], 1
cmp byte [ebx], 0
jne 0x150d2d0
push str.Archive
push ebx
call fcn.0150f6b8
add esp, 8
dec edi
jne 0x150d2e6
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x150d2e6
test al, 0x10
je 0x150d2e6
mov byte [esp], 1
xor eax, eax
jmp 0x150d2fa
and edx, 0xff
cmp edx, 0x3f
jne 0x150d2f9
mov byte [ebx + eax], 0x5f
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x150d2ea
cmp byte [esp], 0
jne 0x150d319
push 0x2e
push ebx
call fcn.0150f791
add esp, 8
test eax, eax
je 0x150d319
mov byte [eax], 0
mov eax, str.UseRAR
mov edx, 1
call fcn.0150da58
test eax, eax
setne al
and eax, 1
test al, al
je 0x150d344
push str..rar
push ebx
call fcn.0150f5dc
add esp, 8
jmp 0x150d352
push str..zip
push ebx
call fcn.0150f5dc
add esp, 8
mov eax, ebx
call fcn.0150b67c
add esp, 0x404
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x150eef0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x15105a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x15105bc
call fcn.01511a68
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x15105d8
test bl, 1
je 0x15105d8
call fcn.01515554
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret