joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013bd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x1aac770], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013f3
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4182e8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4182ec]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.004013b3
mov ecx, dword [0x4182f0]
mov eax, dword [0x4182f4]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1aac770], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1aac76c]
cmove eax, edx
xor edx, edx
cmp dword [0x1aac770], 0x3eb
mov dword [0x1aac76c], eax
mov eax, dword [0x1aac15c]
cmove eax, edx
add ecx, ebx
mov dword [0x1aac15c], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1aac770]
xor eax, edx
mov dword [0x1aac768], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401527
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1aac770]
sub edi, eax
cmp ecx, 0xc
jne 0x401535
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013ba
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x401581
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401431
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d332
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408727
mov dword [ebp - 0x14], eax
cmp dword [0x4e6578], esi
jne 0x40d425
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d505
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d505
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d505
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4e6578], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4e657c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4e6580], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e6588], eax
test eax, eax
je 0x40d422
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e6584], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d43d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d45f
push 4
pop eax
jmp 0x40d507
cmp dword [ebp - 0x14], esi
je 0x40d45f
push dword [0x4e6578]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d444
mov eax, dword [0x4e6584]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4bd
cmp dword [0x4e6588], edi
je 0x40d4bd
push eax
call ebx
push dword [0x4e6588]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4bd
test eax, eax
je 0x40d4bd
call ecx
test eax, eax
je 0x40d4b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b2
test byte [ebp - 8], 1
jne 0x40d4bd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4ed
mov eax, dword [0x4e657c]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
call eax
mov esi, eax
test esi, esi
je 0x40d4ea
mov eax, dword [0x4e6580]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4e6578]
call ebx
test eax, eax
je 0x40d505
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d507
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040407e
mov esp, ebp
pop ebp
ret
Function at 0x1000179f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100017ae
pop dword [ebp - 0x2c]
mov eax, 0x601eb66d
add eax, 0xafe16141
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf047f427
sub dword [ebp - 0x3c], 0xa1f5aedc
mov dword [ebp - 0x38], 0x65f3accd
sub dword [ebp - 0x38], 0x33c06088
mov dword [ebp - 0x34], 0x79cac783
add dword [ebp - 0x34], 0xd2817cab
mov dword [ebp - 0x30], 0xd77f589f
add dword [ebp - 0x30], 0x2880a761
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xc09ac6d4
add eax, 0x4f658970
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x11b627d0
sub dword [ebp - 0x3c], 0x9d43be7a
mov dword [ebp - 0x38], 0x3dc29f02
sub dword [ebp - 0x38], 0xfc563d8d
mov dword [ebp - 0x34], 0xf9a53f00
sub dword [ebp - 0x34], 0x9635d294
mov dword [ebp - 0x30], 0xdc8c2ecb
add dword [ebp - 0x30], 0x2373d135
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x33e4d
push 0
call eax
mov ecx, 0x8c66f94
sub ecx, 0x8c63360
xor esi, esi
add esi, eax
mov edi, 0x659f9122
sub edi, 0x559ef922
add edi, dword [ebp - 0x2c]
mov ebx, 0x55b6b7ed
add ebx, 0xa523865e
sub dword [ebp - 4], ebx
mov edx, dword [edi]
add dword [ebp - 0x28], 0xd923d1f7
sub edx, ebx
xor dword [ebp - 0x14], ecx
mov dword [esi], edx
add dword [ebp - 8], 0xb96a1d85
add esi, 4
add edi, 4
loop 0x100018cd
add eax, 0x1b0c7a1
add eax, 0xfe501c02
mov ebx, eax
add eax, 0xf9cd91fd
add eax, 0x6326e08
mov ecx, 0xd8a9e312
add ecx, 0x37561cee
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10001130
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.1000f180
mov esi, eax
add esp, 4
test esi, esi
jns 0x10001161
push 0x44d
push str.hprof_check.c
push str.fd_0
push 0
push 1
call fcn.10005d50
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.1000f1d0
mov ebx, eax
add esp, 0xc
mov ecx, ebx
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10001194
push 0x44f
push str.hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.10005d50
add esp, 0x14
cmp ebx, 0x200
jg 0x100011b7
push 0x451
push str.hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.10005d50
add esp, 0x14
push 0
push 0
push esi
call fcn.1000f1d0
add esp, 0xc
or eax, edx
je 0x100011e3
push 0x453
push str.hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.10005d50
add esp, 0x14
lea eax, [ebx + 1]
push eax
call fcn.10017890
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000120f
push 0x456
push str.hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.10005d50
add esp, 0x14
push ebp
push ebx
push edi
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
add esp, 0xc
test ebp, ebp
jg 0x1000123c
push 0x45b
push str.hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.10005d50
add esp, 0x14
cmp ebx, ebp
pop ebp
je 0x1000125c
push 0x45d
push str.hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.10005d50
add esp, 0x14
push esi
call fcn.1000edb0
add esp, 4
test edi, edi
jne 0x10001280
mov eax, dword [esp + 0x14]
push eax
push str.No_file_image:__s_n
call fcn.10003330
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1001f834]
mov ecx, dword [eax + 0x10]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b0
test dl, dl
je 0x100012ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001290
xor eax, eax
jmp 0x100012b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d4
push 0x474
push str.hprof_check.c
push str.strcmp__char_p__gdata__header_0
push 0
push 1
call fcn.10005d50
add esp, 0x14
mov eax, dword [esp + 0x14]
push edi
push ebx
push eax
push str.Filename_s__nbytes_d__header__s__n
call fcn.10003330
mov esi, edi
add esp, 0x10
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100012f0
sub esi, ecx
mov eax, dword [esi + edi + 1]
lea edx, [esi + edi]
lea ecx, [edx + 1]
sub ecx, esi
lea esi, [edx + 5]
sub ecx, edi
mov dword [esp + ecx + 0xb], eax
push dword [esp + 0xc]
call fcn.1000f040
add esp, 4
cmp eax, 4
je 0x1000133a
push 0x479
push str.hprof_check.c
push str.idsizesizeof_HprofId_
push 0
push 1
call fcn.10005d50
add esp, 0x14
mov eax, dword [esi]
push eax
call fcn.1000f040
mov eax, dword [esi + 4]
add esi, 8
push eax
call fcn.1000f040
mov eax, edi
sub eax, esi
add eax, ebx
push eax
push esi
call fcn.10015090
push ebx
push eax
push str._d_total_records_found_in__d_bytes_n
call fcn.10003330
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10008990
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], esi
push dword [esi]
call fcn.1000f170
add esp, 4
test eax, eax
js 0x10008ad4
push eax
call fcn.1000edb0
add esp, 4
call fcn.1000f020
mov esi, dword [esi]
mov ecx, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100089d6
sub ecx, edx
push edi
lea eax, [ecx + 0x40]
push eax
mov dword [esp + 0x14], eax
call fcn.10017890
mov ecx, dword [0x1001f834]
add esp, 4
mov byte [esp + 0x1c], 0
mov dword [esp + 0x14], eax
cmp byte [ecx + 0x38], 0x62
je 0x10008a96
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + str..txt]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x1b], al
test al, al
jne 0x10008a10
push ebp
push 0x2e
push esi
call sub.VCRUNTIME140.dll_strrchr
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10008a95
push ebx
mov ebx, ebp
xor edi, edi
sub ebx, str..txt
nop
mov al, byte [ebx + edi + str..txt]
test al, al
je 0x10008a90
movsx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsx ecx, byte [edi + str..txt]
mov esi, eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add esp, 8
cmp eax, esi
jne 0x10008a90
inc edi
cmp edi, 4
jl 0x10008a40
lea edx, [esp + 0x24]
mov ecx, ebp
sub edx, ebp
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10008a80
mov byte [ebp], al
mov esi, dword [esp + 0x10]
pop ebx
pop ebp
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
push esi
push str._s._d_s
push dword [esp + 0x20]
push edi
call fcn.1000ec80
mov eax, dword [esp + 0x30]
push esi
mov dword [eax], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [0x1001f834]
push dword [eax + 0x80]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x20
pop edi
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.10018069
add esp, 0x20
ret
Function at 0x1000e0e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x20000
call fcn.10017890
mov edi, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x20]
mov ebx, eax
nop dword [eax + eax]
mov ecx, 0x20000
cmp edi, ecx
cmovl ecx, edi
push ecx
push ebx
push dword [esp + 0x1c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov esi, eax
add esp, 0xc
test esi, esi
js 0x1000e13d
je 0x1000e153
jle 0x1000e12b
push esi
push ebx
call ebp
add esp, 8
sub edi, esi
test edi, edi
jg 0x1000e100
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push esi
push str.read
call fcn.1000dc50
add esp, 0xc
test edi, edi
jle 0x1000e175
test esi, esi
jne 0x1000e175
push 0x76e
push str.hprof_io.c
push str.File_size_is_smaller_than_bytes_written
push esi
push 1
call fcn.10005d50
add esp, 0x14
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1000ec10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x1000ec54
sub eax, 1
jne 0x1000ec64
mov eax, dword [esp + 0x198]
mov dword [0x1001f830], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x1001f3f0], eax
jmp 0x1000ec64
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x1001f830], 0
mov ecx, dword [esp + 0x190]
mov eax, 1
xor ecx, esp
call fcn.10018069
add esp, 0x194
ret 0xc

Function at 0x1000edc0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
jne 0x1000edef
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10018069
add esp, 0x14
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [esp + 0x20]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
call dword [sym.imp.wsock32.dll_htons]
push 0
mov word [esp + 0xa], ax
mov eax, 2
push 1
push eax
mov word [esp + 0x10], ax
call dword [sym.imp.wsock32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000ee49
push 0x10
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.wsock32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000ee5b
push esi
call dword [sym.imp.wsock32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10018069
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10018069
add esp, 0x14
ret
Function at 0x10015ce0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f834]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10015d22
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005d50
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d40
ret

Function at 0x10017330
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f834]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10017379
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005d50
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d40
ret
Function at 0x4058d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4058e4
pop dword [ebp - 0x40]
mov eax, 0xdc361eaf
add eax, 0x240a3a35
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x5b2d0cc
sub dword [ebp - 0x50], 0xb7608b81
mov dword [ebp - 0x4c], 0xdb3b810c
sub dword [ebp - 0x4c], 0xa90834c7
mov dword [ebp - 0x48], 0x903ea103
sub dword [ebp - 0x48], 0x43f25cd5
mov dword [ebp - 0x44], 0xe84520e9
add dword [ebp - 0x44], 0x17badf17
lea eax, [ebp - 0x50]
push eax
mov eax, 0xc672edf2
add eax, 0x39cd9312
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xeb4c630e
add dword [ebp - 0x50], 0x89260648
mov dword [ebp - 0x4c], 0x95e343fc
add dword [ebp - 0x4c], 0xab891d79
mov dword [ebp - 0x48], 0x9b168d66
sub dword [ebp - 0x48], 0x37a720fa
mov dword [ebp - 0x44], 0x42d8b608
add dword [ebp - 0x44], 0xbd2749f8
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x983600cb
sub eax, 0x97f57fcb
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6c8
push 0
call eax
mov ecx, 0x55d5
mov ebx, eax
mov esi, 0xfa8912c4
sub esi, 0xfa440ec4
add esi, dword [ebp - 0x40]
mov edi, 0xffb64161
sub dword [ebp - 0x14], 0x8a022beb
mov edx, dword [esi]
xor dword [ebp - 0x10], 0xde34d45c
sub edx, edi
add dword [ebp - 0x3c], ebx
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x6066664b
add ebx, 4
add esi, 4
loop 0x4059fa
add eax, 0x2f30434f
add eax, 0xd0d106d8
xor ebx, ebx
add ebx, eax
add eax, 0x3fec870b
sub eax, 0x3fec8706
mov ecx, 0xd679b360
sub ecx, 0xd639b360
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x405ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa50
push esi
call fcn.004060e4
push esi
call fcn.00405b43
mov edi, eax
test edi, edi
jne 0x405bc1
xor eax, eax
jmp 0x405c19
push edi
call fcn.00406378
test byte [0x434ef8], 0x80
je 0x405bde
mov ax, word [edi]
test ax, ax
je 0x405bbd
cmp ax, 0x5c
je 0x405bbd
sub edi, esi
sar edi, 1
jmp 0x405bf8
call fcn.00406427
test eax, eax
je 0x405bf2
test byte [eax], 0x10
je 0x405bbd
push esi
call fcn.00405ae4
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405be4
call fcn.00405a98
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405c94
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405cb3
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405cb9
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x40176e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x130
push 0x4012a0
call fcn.00401f88
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4018a5
cmp dword [ebp - 0x9c], 2
jne 0x4018a5
push 4
pop eax
cmp dword [ebp - 0xa8], eax
jne 0x4018a5
and dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0x401290
push 0x401264
mov edi, 0x80000002
push edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
call esi
test eax, eax
jne 0x4018a5
cmp word [ebp - 0xb0], 0x300
jne 0x4018a5
mov ebx, 0x88
mov dword [ebp - 0xb4], ebx
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x401258
push 0x4011f8
push edi
call esi
test eax, eax
jne 0x4018a5
cmp dword [ebp - 0xb4], ebx
jne 0x4018a5
mov ecx, ebx
lea edi, [ebp - 0x13c]
mov esi, section..data
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40185d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4018a5
push 0x4011ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x140], eax
test eax, eax
je 0x4018a5
push 0x4011d8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401899
and dword [ebp - 4], 0
call eax
jmp 0x401895
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401fc1
ret

Function at 0x401bf1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 8], edi
mov ebx, dword [ebp + 0x10]
push 1
push 0x401508
push ebx
jmp loc.0041e495

Function at 0x41d4da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret 4
movzx eax, word [esi]
pop esi
add esi, dword [edi + eax*4]
jmp 0x418852
ja 0x4189b9
xor eax, 0xa250bca4
sbb eax, dword [esp + 4]
jne 0x41d516
lea esi, [ebx]
jmp 0x41d4c7
je 0x41d529
push 0
pop eax
imul eax, eax, 0xf
push eax
jmp 0x41d48d
movzx eax, byte [edi]
sub dword [esp], eax
lea edi, [edi + 1]
pop eax
cmp byte [edi], 1
jmp 0x418894
lea edi, [ebx]
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
push ebx
lea esi, [esi + ecx*2]
jmp 0x418877
mov edx, ebx
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
jmp 0x41d50d
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
lodsd eax, dword [esi]
jmp 0x41d550
ret
inc ecx
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
jmp 0x4189b0