joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4
Function at 0x401560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
movaps xmm0, xmmword [0x43a600]
movups xmmword [ebp - 0xa0], xmm0
push ebx
movaps xmm0, xmmword [0x43a5a0]
movups xmmword [ebp - 0x90], xmm0
push esi
movaps xmm0, xmmword [0x43a5d0]
movups xmmword [ebp - 0x80], xmm0
push edi
movaps xmm0, xmmword [0x43a5e0]
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0xed
movaps xmm0, xmmword [0x43a5f0]
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x5c], 0x81
movaps xmm0, xmmword [0x43a5c0]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x18], 0x23
movaps xmm0, xmmword [0x43a5b0]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x14], 0x7e
movaps xmm0, xmmword [0x43a590]
movups xmmword [ebp - 0x28], xmm0
call fcn.00401480
mov ebx, eax
xor edi, edi
mov eax, 1
mov dword [ebp - 0x10], ebx
sub eax, ebx
mov esi, ebx
mov dword [ebp - 4], eax
mov eax, 2
sub eax, ebx
mov dword [ebp - 8], eax
mov eax, 3
sub eax, ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, 0x38e38e39
mul edi
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
lea ecx, [ebx + esi]
movzx eax, byte [ebp + eax*4 - 0x58]
xor byte [esi], al
mov eax, 0x38e38e39
mul ecx
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 8]
movzx eax, byte [ebp + eax*4 - 0x54]
lea ecx, [ecx + esi]
xor byte [esi + 1], al
mov eax, 0x38e38e39
mul ecx
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ebp + eax*4 - 0x50]
lea ecx, [ecx + esi]
xor byte [esi + 2], al
lea esi, [esi + 4]
mov eax, 0x38e38e39
mul ecx
mov eax, edi
add edi, 4
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
movzx eax, byte [ebp + eax*4 - 0x4c]
xor byte [esi - 1], al
cmp edi, 0x12800
jb 0x401615
mov esi, dword [ebp - 0x10]
xor edi, edi
mov eax, 0x38e38e39
mul edi
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
lea ecx, [esi + ebx]
movzx eax, byte [ebp + eax*4 - 0xa0]
xor byte [esi], al
mov eax, 0x38e38e39
mul ecx
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 8]
movzx eax, byte [ebp + eax*4 - 0x9c]
lea ecx, [esi + ecx]
xor byte [esi + 1], al
mov eax, 0x38e38e39
mul ecx
mov eax, edi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ebp + eax*4 - 0x98]
lea ecx, [esi + ecx]
xor byte [esi + 2], al
lea esi, [esi + 4]
mov eax, 0x38e38e39
mul ecx
mov eax, edi
add edi, 4
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
movzx eax, byte [ebp + eax*4 - 0x94]
xor byte [esi - 1], al
cmp edi, 0x12800
jb 0x4016a6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402850
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, edx
test ecx, ecx
je 0x40287b
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x14]
add edx, 0x14
cmp eax, edx
je 0x40287b
nop word [eax + eax]
cmp dword [eax + 0x10], ecx
je 0x40287f
mov eax, dword [eax]
cmp eax, edx
jne 0x402870
xor eax, eax
pop esi
ret
mov dword [eax + 0x10], esi
mov eax, 1
pop esi
ret

Function at 0x402890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
jne 0x4028b3
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + esi + 0x20]
mov edx, dword [eax + esi + 0x24]
add ecx, esi
push edi
mov edi, dword [eax + esi + 0x1c]
add edx, esi
mov eax, dword [eax + esi + 0x18]
add edi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40291a
mov edx, dword [ecx]
mov ecx, ebx
add edx, esi
call fcn.00401750
mov esi, eax
test edx, edx
je 0x402932
test ebx, ebx
je 0x402932
xor ecx, ecx
test esi, esi
je 0x402911
mov edi, ebx
sub edi, edx
mov al, byte [edx]
mov bl, byte [edi + edx]
cmp al, bl
jb 0x40292f
ja 0x40292f
inc ecx
inc edx
cmp ecx, esi
jb 0x402900
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
movzx eax, word [edx]
test eax, eax
je 0x402924
lea edi, [edi + eax*4]
mov eax, dword [edi]
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
mov edx, dword [ebp - 4]
add ecx, 4
mov esi, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
cmp eax, dword [ebp - 0x18]
jb 0x4028e1
jmp 0x402914
Function at 0x4046e0
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x30]
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x14]
test edi, edi
je 0x404735
nop dword [eax + eax]
mov edx, dword [edi + 0x28]
xor eax, eax
movzx esi, word [edi + 0x24]
nop dword [eax]
mov cl, byte [edx]
ror eax, 0xd
cmp cl, 0x61
movzx ecx, cl
jb 0x404720
add eax, 0xffffffe0
add eax, ecx
inc edx
sub esi, 1
jne 0x404710
cmp eax, 0x6a4abc5b
je 0x40473d
mov edi, dword [edi]
test edi, edi
jne 0x404700
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [edi + 0x10]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [ebp - 8], eax
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
add esi, ebx
add edi, ebx
mov edx, dword [esi]
add edx, ebx
xor ecx, ecx
mov al, byte [edx]
nop
ror ecx, 0xd
lea edx, [edx + 1]
movsx eax, al
add ecx, eax
mov al, byte [edx]
test al, al
jne 0x404760
cmp ecx, dword [ebp - 4]
je 0x40477e
add esi, 4
add edi, 2
jmp 0x404757
mov eax, dword [ebp - 8]
movzx ecx, word [edi]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ae5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x42f2c9
call fcn.0041a26a
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x407b8f
push dword [ebp + 8]
mov ecx, eax
call fcn.00407e1d
mov esi, eax
test esi, esi
je 0x407c22
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x407b78
push edx
call fcn.00404e7e
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407b78
xor edi, edi
inc edi
jmp 0x407b82
push dword [ebx]
call fcn.00404e79
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00407a08
jmp 0x407c20
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.0041a135
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x407c18
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00404e7e
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x407c12
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.004079e4
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.004079e4
add al, bl
mov edx, edi
test edx, edx
jns 0x407c03
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x407bda
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00404a29
mov eax, edi
call fcn.0041a233
ret 0x10

Function at 0x407c2a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x407c7d
push esi
push dword [ebp + 8]
call fcn.00407e1d
mov edi, eax
test edi, edi
jne 0x407c4d
mov eax, dword [ebp + 0x10]
jmp 0x407c8f
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407c48
mov eax, dword [ebp - 8]
jmp 0x407c8f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x427dea
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427aaa

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000a520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [0x1001504c]
sub eax, 0x1160
mov dword [0x10015050], eax
mov dword [0x10015054], 0
mov dword [0x10015058], 0
mov dword [0x1001505c], 0
mov eax, dword [0x1001504c]
sub eax, 0x8e4
mov dword [0x1001504c], eax
mov dword [ebp - 0x20], 0
mov dword [0x1001504c], 0x2550
mov dword [0x1001504c], 0x1f86
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
jae 0x1000a6ce
mov eax, 0x100
mov dword [0x1001504c], 0x1012
mov ecx, dword [0x10015054]
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x30]
idiv ecx
mov dword [0x10015054], edx
mov edx, dword [0x10015050]
sub edx, 0x5b4
mov dword [0x1001504c], edx
mov edx, dword [0x10015058]
mov esi, dword [0x10015054]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10015058], edx
mov dword [0x1001504c], 0x1cb8
mov edx, dword [0x10015054]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [ebp - 0x21], bl
mov edx, dword [0x10015058]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov edx, dword [0x10015054]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov dword [0x10015050], 0xc3
mov bl, byte [ebp - 0x21]
mov edx, dword [0x10015058]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x10015054]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
mov esi, dword [0x10015058]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x1001505c], edx
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
mov esi, dword [0x1001505c]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
mov edx, dword [0x1001504c]
sub edx, 0x736
mov dword [0x10015050], edx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x1000a59f
mov dword [0x1001504c], 0xc1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000b530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.1000b530]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1000b556
jmp 0x1000b572
mov al, 1
test al, 1
jne 0x1000b53f
jmp 0x1000b584
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x1000b570
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1000b58b
jmp 0x1000b572
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
jmp 0x1000b54e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 8
pop ebp
ret
Function at 0x402907
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402916
pop dword [ebp - 0x2c]
mov eax, 0xf2e185e9
sub eax, 0xf2a15cd3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9922f216
add dword [ebp - 0x3c], 0xb52f5335
mov dword [ebp - 0x38], 0x32732ad0
sub dword [ebp - 0x38], 0x3fde8b
mov dword [ebp - 0x34], 0x822630c3
sub dword [ebp - 0x34], 0x35d9ec95
mov dword [ebp - 0x30], 0x8b2b28ed
add dword [ebp - 0x30], 0x74d4d713
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6b987e6b
sub dword [ebp - 0x3c], 0xf7261515
mov dword [ebp - 0x38], 0xc55bf6a6
sub dword [ebp - 0x38], 0x83ef9531
mov dword [ebp - 0x34], 0x218f95d1
sub dword [ebp - 0x34], 0xbe202965
mov dword [ebp - 0x30], 0xc97ee048
sub dword [ebp - 0x30], 0xc97ee048
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x7ae0239
add eax, 0xf8926de7
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2cc
push 0
call eax
mov ecx, 0xa7ad390f
sub ecx, 0xa7ace752
mov edi, eax
mov esi, 0x55c07751
add esi, 0xaa8050af
add esi, dword [ebp - 0x2c]
mov ebx, 0x8192e892
sub ebx, 0x1050a240
add dword [ebp - 8], edi
mov edx, dword [esi]
xor dword [ebp - 0xc], ebx
sub edx, ebx
mov dword [ebp - 0x14], 0x8cb373f2
mov dword [edi], edx
add edi, 4
add esi, 4
loop 0x402a33
add eax, 0x69584fae
sub eax, 0x695715e7
mov ebx, eax
add eax, 0x2da40a5a
add eax, 0xd25bf5ab
mov ecx, 0x4fd52ba3
sub ecx, 0x4f952ba3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00402907
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.00402907
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x4047c0
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406a17
call fcn.004054fb
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x404937
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x404930
cmp dword [ebx + edi*4], 0
je 0x404923
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404923
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x40491d
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x40491d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40491d
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40491d
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00402907
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x40490e
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x40490e
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x40490e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x40490e
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404ac6
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401788
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x404826
push ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.004054b6
ret

Function at 0x404b63
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00402907
pop ecx
push 2
call dword [sym.imp.kernel32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
call fcn.004047c0
test al, al
jne 0x404b92
xor eax, eax
inc eax
jmp 0x404ba1
push esi
call fcn.004049c0
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x406c20
Capabilities:
Compute adler32 checksum

Disassembly:
jmp 0x406c30
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x406d43
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
movzx ecx, di
shr edi, 0x10
test ebp, ebp
je 0x406d38
push ebx
mov edx, 0x15b0
cmp ebp, edx
cmovb edx, ebp
sub ebp, edx
cmp edx, 0x10
jb 0x406cfc
mov ebx, edx
shr ebx, 4
movzx eax, byte [esi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add edi, ecx
add esi, 0x10
add ecx, eax
add edi, ecx
dec ebx
jne 0x406c70
test edx, edx
je 0x406d0b
movzx eax, byte [esi]
inc esi
add ecx, eax
add edi, ecx
dec edx
jne 0x406d00
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebp, ebp
jne 0x406c56
pop ebx
shl edi, 0x10
or edi, ecx
mov eax, edi
pop edi
pop ebp
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x4084f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x294]
cmp eax, 0xffffffff
je 0x40850f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x294], 0xffffffff
mov eax, dword [esi + 0x298]
cmp eax, 0xffffffff
je 0x40852b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x298], 0xffffffff
mov ecx, esi
pop esi
jmp fcn.004117b0