joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bc6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bb91
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
cmp dword [ebp - 0x14], 0
jne 0x40bba8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bc56
cmp dword [ebp - 0x14], 0x70000000
jb 0x40bbb6
call fcn.00409818
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40bb5a
test eax, eax
jne 0x40bc56
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40bc04
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bc56
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bc0c
dec esi
test esi, esi
je 0x40bc1b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bc0b
cmp dword [ebp - 0x10], 7
jne 0x40bc26
test esi, esi
je 0x40bc26
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bc49
test esi, esi
je 0x40bc49
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc73
lea eax, [ebp - 4]
call fcn.00404c88

Function at 0x40c6b0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40c6cc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c6ce
shr eax, 1
dec edx
jne 0x40c6bf
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c6b8
pop esi

Function at 0x40c6e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d98], 0
jne 0x40c707
call fcn.0040c6b0
push 1
push 0x417d98
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c732
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d9c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c70d
mov eax, ebx
pop edi
pop esi
pop ebx
Function at 0x40c738
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov edx, ebx
mov ecx, esi
or eax, 0xffffffff
call fcn.0040c6e4
xor eax, 0xffffffff
pop esi
pop ebx
and eax, 0x7c79a2b1
loopne 0x40c703
mov byte [0x5037c79], al
xor ah, byte [ecx + eax*2]
add byte [ecx + 0x7cc48fcb], al
jbe 0x40c7ab
inc ecx
cmp dword [0x41262e], ebp
jae 0x40c771
or esi, 0xf4c9961d
dec esi
xchg ebx, edx
sub ecx, 0x6a1879d8
not esi
and eax, 0x38597c69
and ecx, eax
xor ecx, 0xc3dce3b9
sub esi, ebx
mov ecx, 0x7338af15
xchg edi, esi
shr eax, 0x16
inc edx
sub eax, 0xd9e6e953
sub edx, dword [0x412323]
dec edx
add edx, esi
cmp esp, esi
jl 0x40c7b0
and edx, dword [0x412874]
inc edi
not ebx
rol edx, 0x17
dec ecx
jne 0x40c791
xchg ebx, eax
shl edx, 0x18
or esi, 0x9cba9e46
shr ebx, 0xd
add dword [0x412e90], ecx
ror edx, 1
and eax, 0x8279dc35
inc edi
mov esi, 0x2c5cc7dc
xor eax, ebp
add eax, 0x6b6117f6
xor edx, edx
ror ebx, 5
neg esi
cmp dword [0x412964], ebp
jl 0x40c7f6
add ebx, esp
mov ecx, 0x6a8fd257
not eax
xchg ebx, eax
ror edi, 0x18
or edx, dword [0x412241]
inc edi
shr edx, 0x13
call fcn.0040eab2
xchg edi, eax
mov dword [0x412e12], edi
xor eax, 0x3a5b9438
dec ecx
jne 0x40c7fb
dec edi
neg esi
call fcn.004083c8
add edx, ebx
mov ecx, 0x57c37773
not esi
rol esi, 0xf
shr esi, 0x1a
rol esi, 0x17
test ecx, 0x25676021
jl 0x40c84b
add eax, 0xf70b6b3a
neg edi
invalid
xor eax, 0x412e6d
push edx

Function at 0x40df08
Capabilities:
Shutdown system

Disassembly:
not ebx
xor edi, 0x616e67dc
xor dword [0x412e1d], ecx
xor esi, eax
xchg ecx, edx
add ebx, 0xf11d7f8a
xor dword [0x412e8f], 0xd5a3521a
sub ecx, 0x31387530
xor esi, edi
sub esi, 0x9a998b81

Function at 0x40e5f4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e64e
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e61a
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e628
cmp edi, 1
jle 0x40e628
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e180
test eax, eax
jne 0x40e64e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e64e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e64e
inc edi
dec esi
jne 0x40e60a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40e658
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e67c
mov eax, dword [ebp - 4]
jmp 0x40e67f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x40e684
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x40e6d1
xor ebx, ebx
jmp 0x40e6c6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407bdc
test eax, eax
jne 0x40e6c5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40e77b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
ret
call edi
test al, al
jne 0x40e6a7
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x40e6dd
je 0x40e6e6
jmp 0x40e6ef
call fcn.0040bcb4
mov esi, eax
jmp 0x40e6f1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x40e6f1
xor esi, esi
test si, si
je 0x40e77b
xor ebx, ebx
jmp 0x40e717
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x40e716
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e77b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e6fe
xor ebx, ebx
jmp 0x40e770
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40e76f
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x40e764
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0040e658
push eax
mov eax, esi
call fcn.0040e658
pop edx
cmp edx, eax
jne 0x40e76f
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e77b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
ret
call edi
test al, al
jne 0x40e726
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x40eb68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ec3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ec58
push ebx
push 0x40ec68
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ebe8
mov al, 0x6a
call fcn.0040e788
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb3c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ebf1
call fcn.0040eb3c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ec44
lea eax, [ebp - 4]
call fcn.00404c88
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.kernel32
call esi
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3d3843d2
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x6bad26f2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x417bc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00417bd7

Function at 0x419d90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
push ebx
push str.main_cmd__ls
push 5
call fcn.00422d60
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push dword [ebp - 4]
mov edi, eax
push str.main_argc__d
push 5
call fcn.00422d60
add esp, 0xc
test edi, edi
jne 0x419e41
push str.main_argv_null__m
push 5
call fcn.00422d60
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
push edi
push edi
push ebx
call fcn.00418de0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea eax, [eax + esi*2]
add eax, eax
push eax
call fcn.0053fcf5
mov edi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [edi + esi*4]
push eax
push edi
push ebx
call fcn.00418de0
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], 0
push eax
push str.main_argc2__d
push 5
mov dword [ebp - 4], eax
call fcn.00422d60
add esp, 0x40
mov ecx, dword [ebp - 4]
xor esi, esi
lea ebx, [ecx*4 + 4]
mov dword [ebp - 0xc], ebx
test ecx, ecx
jle 0x419e78
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [edi + esi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 4]
inc esi
add ebx, eax
cmp esi, ecx
jl 0x419e54
mov eax, dword [ebp + 8]
push ebx
mov dword [eax], ecx
call fcn.0053fcf5
mov ecx, dword [ebp + 0xc]
xor esi, esi
add esp, 4
mov dword [ecx], eax
cmp dword [ebp - 4], esi
jle 0x419ed1
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx]
push 0
push 0
lea eax, [ecx + edx]
mov dword [ecx + esi*4], eax
mov eax, ebx
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push dword [eax + esi*4]
push 0xffffffffffffffff
push dword [edi + esi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0xc]
inc esi
mov ecx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
cmp esi, dword [ebp - 4]
jl 0x419e95
cmp dword [ebp - 8], 0
mov eax, dword [ecx]
push edi
mov dword [eax + esi*4], 0
je 0x419eee
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0053fcf0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov dword [0x5fa824], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5696d4
mov edi, eax
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x41b613
xor esi, esi
jmp 0x41b63b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41b623
xor esi, esi
jmp 0x41b63b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41b63b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
push esi
call fcn.00539bc0
add esp, 4
test eax, eax
jne 0x41b679
lea eax, [ebp + 4]
sub eax, 4
push 0x5696e4
push eax
call fcn.0041f6e0
push 0
push 0
push 0
push 1
push dword [eax]
push str.dll_failed_loading_mem_res
call fcn.00418b70
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push eax
call fcn.0041e520
push eax
call fcn.00539bc0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41b6bf
lea eax, [ebp + 4]
sub eax, 4
push 0x5696e4
push eax
call fcn.0041f6e0
push esi
push esi
push esi
push 1
push dword [eax]
push str.dll_failed_loading_mem_mod
call fcn.00418b70
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.mem_loaded_sdk_dll_0x_p
push 5
call fcn.00422d60
add esp, 0xc
mov dword [0x5fa828], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d500
Capabilities:
Terminate process

Disassembly:
push dword [0x5f6d2c]
push str.Luminati_Net_Updater
push str.net_updater__OPTIONS_____s__s_n___h___print_this_message_n____updater_appid___run_init_monitor_with_provided_appid._n____install_appid___install_service_with_provided_appid_n____install_ui_appid___install_service_with_provided_appid_after_showing_dialog_and_getting_user_permission_n____uninstall_appid___remove_service_with_provided_appid__must_match_appid_used_during_install__n____camp_campid___campaign_id_n____dlg_pos__ownerscreentop:left__n____dlg_txt_cult_culture_n____dlg_bg_color_color___i.e.__ff112233__n____dlg_btn_color_color_n____dlg_txt_color_color_n____dlg_app_name_name_n____dlg_tos_link_tos_n____dlg_logo_link_logo_n____dlg_benefit_txt_benefit_txt_n____dlg_peer_txt__remove_adspremium_verfree_appi_agree__n____dlg_not_peer_txt__adslimitedsubscriptionpayno_thank_you__n
push 2
call fcn.00540093
add esp, 4
push eax
call fcn.00419d00
add esp, 0x10
push 1
call fcn.0053ffb5
int3
Function at 0x41da20
Capabilities:
Terminate process

Disassembly:
push dword [0x5f6d2c]
push 0x569ab4
push 2
call fcn.00540093
add esp, 4
push eax
call fcn.00419d00
add esp, 0xc
push 0x4d2
call fcn.0053ffb5
int3
Function at 0x41f180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004204f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41f1d5
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.00420dd0
add esp, 8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 8]
push eax
call fcn.00420da0
add esp, 4
push 2
call fcn.00540093
push eax
push dword [ebp - 4]
call fcn.005463f1
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x41f1f8
push eax
call fcn.0053fcf0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x421a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, 0x40
push edi
xor edi, edi
cmp esi, eax
cmovle esi, eax
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x421ab0
call fcn.0053fcd2
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
push esi
push ebx
mov dword [ebp + 0x14], eax
call fcn.004205f0
push dword [ebp + 0xc]
lea eax, [esi + 1]
push eax
push 1
push dword [ebx]
call fcn.005402f1
add esp, 0x18
test eax, eax
jle 0x421b0b
add edi, eax
cmp eax, esi
jle 0x421b0b
add esi, esi
lea eax, [esi + edi]
cmp eax, 0x40000000
jge 0x421b3a
inc eax
push eax
push dword [ebx]
call fcn.00545dc2
push dword [ebp + 0xc]
lea ecx, [esi + 1]
mov dword [ebx], eax
push ecx
add eax, edi
push 1
push eax
call fcn.005402f1
add esp, 0x18
test eax, eax
jg 0x421ad6
mov esi, dword [ebp + 0x14]
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x421b1d
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x421b2f
call fcn.0053fcd2
pop edi
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x1b
jmp 0x421b0e
Function at 0x421da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push esi
call fcn.00422830
push eax
push dword [ebp + 8]
call fcn.004221a0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x421dcb
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0xffffffff
jne 0x421de9
mov edi, edx
lea ebx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x421de0
sub edi, ebx
push ecx
push edi
push 1
push edx
call fcn.00546d14
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x421e92
push esi
call fcn.004225f0
add esp, 4
test eax, 0x1000
jne 0x421e71
push esi
call fcn.004225f0
and eax, 0xf
add esp, 4
cmp al, 6
ja 0x421e92
push esi
call fcn.004225f0
and eax, 0xf
add esp, 4
cmp al, 5
jbe 0x421e71
push esi
call fcn.004225f0
add esp, 4
test eax, 0x1300
jne 0x421e71
push esi
call fcn.004225f0
push dword [ebp + 0x14]
mov esi, eax
and esi, 0xc90000
or esi, 0x360000
shr esi, 0x10
call fcn.004225f0
and eax, 0xf
add esp, 8
cmp dword [esi*4 + 0x5feb00], eax
jl 0x421e92
mov esi, dword [ebp + 0x14]
push ebx
push edi
push dword [ebp + 8]
push str.failed_fwrite__s__sz__d__returned__d
push esi
call fcn.004225f0
add esp, 4
or eax, 0x360000
push eax
call fcn.00422d60
add esp, 0x14
push dword [ebp - 4]
call fcn.00546936
add esp, 4
sub ebx, edi
neg ebx
sbb ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421f30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x10000
call fcn.0053fcf5
mov esi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push esi
or edi, 0xffffffff
call fcn.0053ad70
add esp, 0xc
test eax, eax
jne 0x422013
push 0x56b4e4
push esi
call fcn.0053a610
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x422013
push 0x56b65c
push dword [ebp + 0xc]
call fcn.0053a610
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x421ff8
mov edi, dword [ebp - 0x2c]
mov ecx, edi
mov ebx, dword [ebp - 0x28]
or ecx, ebx
je 0x421fee
nop
test ebx, ebx
jl 0x421fb5
jg 0x421fae
cmp edi, 0x10000
jbe 0x421fb5
mov esi, 0x10000
jmp 0x421fb7
mov esi, edi
push dword [ebp - 8]
push esi
push 1
push dword [ebp - 4]
call fcn.005402f1
add esp, 0x10
cmp eax, esi
jne 0x421ff2
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.00546d14
add esp, 0x10
cmp eax, esi
jne 0x421ff2
mov eax, esi
cdq
sub edi, eax
mov eax, edi
sbb ebx, edx
or eax, ebx
jne 0x421fa0
xor edi, edi
jmp 0x421ff5
or edi, 0xffffffff
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call fcn.00546936
mov eax, dword [ebp - 0xc]
add esp, 4
test eax, eax
je 0x422013
push eax
call fcn.00546936
add esp, 4
push ebx
call fcn.0053fcf0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push fcn.00420da0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.0041f380
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [0x5fa864]
test eax, eax
jne 0x422484
push esi
push str.TEMP
call fcn.00539c80
add esp, 4
test eax, eax
jne 0x42241a
push 0x56b520
call fcn.00539c80
add esp, 4
test eax, eax
jne 0x42241a
push dword [ebp - 4]
call fcn.00420e10
mov eax, dword [ebp - 4]
add esp, 4
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x4223d0
push esi
push dword [ebp - 4]
call fcn.00420e30
mov ecx, dword [ebp - 4]
add esp, 8
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 4]
push dword [eax]
push 0x5fa864
call fcn.004205a0
jmp 0x422425
push 0x56b524
call fcn.00539c80
add esp, 4
test eax, eax
je 0x422488
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x5dc6f8], 4
je 0x422488
cmp byte [eax + 1], 0x3a
jne 0x422488
movsx eax, dl
push eax
push str._c:_Temp
push 0x5fa864
call fcn.004204d0
add esp, 0xc
jmp 0x422428
push eax
push 0x5fa864
call fcn.00420440
add esp, 8
lea eax, [ebp - 0x3c]
push eax
push dword [0x5fa864]
call fcn.0053ad70
add esp, 8
pop esi
test eax, eax
jne 0x422453
movzx eax, word [ebp - 0x36]
test eax, eax
je 0x422453
and eax, 0xf000
cmp eax, 0x4000
je 0x42247f
push dword [0x5fa864]
push str.creating_temp_directory__s
push 0x360004
call fcn.00422d60
push 0x1ff
push dword [0x5fa864]
call fcn.0053a1f0
add esp, 0x14
test eax, eax
jne 0x422497
mov eax, dword [0x5fa864]
mov esp, ebp
pop ebp
ret
push str.failed_to_get_temp_directory
push 0x360000
call fcn.004232c0
push str.failed_to_create_temp_directory
push 0x360000
call fcn.004232c0
int3