joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407511
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4075a1
mov esi, eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov edi, eax
je 0x407572
push 0x4203b0
push edi
call sub.msvcrt.dll_wcscpy
pop ecx
pop edx
lea eax, [edi + ebx*2]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4075a6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4075b6
shr eax, 4
and eax, 1
jmp 0x4075a9
xor eax, eax
dec eax
jmp 0x4075ae
xor eax, eax
dec eax
mov esi, dword [ebp - 0x10]
mov esp, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 2
mov esi, dword [ebp - 0x10]
je 0x4075ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 3
setne al
neg eax
jmp 0x4075ac

Function at 0x4075dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x40767c
mov esi, eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov edi, eax
je 0x40763d
push 0x4203b0
push edi
call sub.msvcrt.dll_wcscpy
pop ecx
pop edx
lea eax, [edi + ebx*2]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor esi, esi
dec esi
test eax, eax
je 0x407681
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407681
mov ecx, edi
and eax, 0x10
mov edi, dword [ebp - 0x10]
je 0x407684
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
mov esi, eax
jmp 0x407684
xor esi, esi
dec esi
jmp 0x407686
mov edi, dword [ebp - 0x10]
mov esp, edi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407724
mov esi, eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov edi, eax
je 0x4076f1
push 0x4203b0
push edi
call sub.msvcrt.dll_wcscpy
pop ecx
pop edx
lea eax, [edi + ebx*2]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407729
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407739
mov ecx, eax
xor eax, eax
test cl, 0x10
sete al
jmp 0x40772c
xor eax, eax
dec eax
jmp 0x407731
xor eax, eax
dec eax
mov esi, dword [ebp - 0x10]
mov esp, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 2
mov esi, dword [ebp - 0x10]
je 0x40772f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 3
setne al
neg eax
jmp 0x40772f

Function at 0x4077f1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
push ecx
call fcn.00407168
pop ecx
mov ebx, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407887
mov edi, eax
mov dword [ebp - 0x10], esp
mov ecx, ebx
xor ebx, ebx
test ecx, ecx
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test ecx, ecx
mov dword [ebp - 0x14], eax
je 0x40785a
push 0x4203b0
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x14]
add esp, 8
lea eax, [eax + ebx*2]
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x40788c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x407891
xor eax, eax
inc eax
jmp 0x4078a6
xor eax, eax
dec eax
jmp 0x4078ab
xor eax, eax
dec eax
jmp 0x4078a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0xb7
setne al
neg eax
mov ecx, dword [ebp - 0x10]
mov esp, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4078b3
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4079d4
mov esi, eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov dword [ebp - 0x18], eax
je 0x40791f
push 0x4203b0
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x18]
add esp, 8
lea eax, [eax + ebx*2]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor esi, esi
dec esi
test eax, eax
je 0x4079d9
mov edi, dword [ebp + 0xc]
push edi
call fcn.00407168
pop ecx
mov ebx, eax
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4079d9
mov edi, eax
mov ecx, ebx
xor ebx, ebx
test ecx, ecx
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test ecx, ecx
mov dword [ebp - 0x14], eax
je 0x40799f
push 0x4203b0
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x14]
add esp, 8
lea eax, [eax + ebx*2]
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
mov edi, dword [ebp - 0x10]
je 0x4079dc
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor esi, esi
cmp eax, 1
sbb esi, esi
jmp 0x4079dc
xor esi, esi
dec esi
jmp 0x4079de
mov edi, dword [ebp - 0x10]
mov esp, edi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4079e8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407b3e
mov esi, eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov dword [ebp - 0x18], eax
je 0x407a54
push 0x4203b0
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x18]
add esp, 8
lea eax, [eax + ebx*2]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
dec ebx
test eax, eax
je 0x407b35
mov esi, dword [ebp + 0xc]
push esi
call fcn.00407168
pop ecx
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407b35
mov esi, eax
xor ebx, ebx
test edi, edi
setne bl
lea eax, [eax + ebx*4]
shl ebx, 2
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00415318
mov eax, esp
test edi, edi
mov dword [ebp - 0x14], eax
je 0x407ad6
push 0x4203b0
push eax
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x14]
add esp, 8
lea eax, [eax + ebx*2]
push esi
push eax
push 0xffffffffffffffff
mov edi, dword [ebp + 0xc]
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x407b4b
push 3
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
test eax, eax
jne 0x407b37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ebx, dword [ebp - 0x10]
jne 0x407b30
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004078b3
pop ecx
pop edx
cmp eax, 0xffffffff
je 0x407b30
push edi
call fcn.0040724e
pop ecx
test eax, eax
je 0x407b3a
xor esi, esi
dec esi
jmp 0x407b3a
mov esi, ebx
mov ebx, dword [ebp - 0x10]
mov esp, ebx
jmp 0x407b41
xor esi, esi
dec esi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
dec esi
jmp 0x407b37

Function at 0x407ba8
Capabilities:
Get token membership

Disassembly:
push edi
push esi
sub esp, 0x10
lea eax, [esp + 8]
mov word [eax + 4], 0x500
and dword [eax], 0
mov ecx, esp
and dword [ecx], 0
sub esp, 0x2c
mov dword [esp + 0x28], ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x4203c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
and dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x407c16
lea edi, [esp + 4]
and dword [edi], 0
push edi
push dword [esp + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp esi, 1
sbb eax, eax
or eax, dword [edi]
jmp 0x407c19
xor eax, eax
dec eax
add esp, 0x10
pop esi
pop edi
ret
Function at 0x407ce8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x407daf
mov ecx, eax
mov ebx, esp
lea eax, [eax*2 + 5]
inc ecx
and eax, 0xfffffffc
call fcn.00415318
mov edi, esp
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor esi, esi
test eax, eax
je 0x407db6
mov dword [ebp - 0x14], ebx
sub esp, 0x20
movaps xmm0, xmmword [0x4203e0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], edi
and dword [esp + 0x1c], 0
and dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x407db3
mov ebx, eax
push eax
call sub.msvcrt.dll_malloc
pop ecx
test eax, eax
je 0x407db3
push 0
push 0
push ebx
mov dword [ebp - 0x10], eax
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
mov ebx, dword [ebp - 0x14]
je 0x407db6
push dword [ebp - 0x10]
call sub.msvcrt.dll_strlen
pop ecx
cmp eax, 2
jb 0x407dc2
mov esi, dword [ebp - 0x10]
push esi
call sub.msvcrt.dll_strlen
pop ecx
cmp byte [esi + eax - 1], 0x5c
jne 0x407db6
mov byte [esi + eax - 1], 0
jmp 0x407db6
xor esi, esi
jmp 0x407db8
mov ebx, dword [ebp - 0x14]
mov esp, ebx
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp - 0x10]
jmp 0x407db6

Function at 0x409735
Capabilities:
Read file on windows

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov esi, esp
and dword [esi], 0
push 0
push esi
push ecx
push eax
push dword [edx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [esi]
mov eax, ecx
add esp, 4
pop esi
ret

Function at 0x409765
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, esp
and dword [edi], 0
push 0
push edi
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete al
cmp dword [edi], esi
setne cl
or cl, al
movzx eax, cl
neg eax
add esp, 4
pop esi
pop edi
ret
Function at 0x40992c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x4099c7
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 4]
and dword [eax + 0x12], 0
movups xmmword [eax], xmm0
and dword [eax + 0xe], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4099c7
movsx eax, word [esp + 4]
movsx ebx, word [esp + 6]
lea ebp, [esp + 0x20]
and dword [ebp], 0
imul ebx, eax
and dword [esp], 0
push ebp
push 0
push ebx
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor edi, edi
dec edi
test eax, eax
je 0x4099ca
movzx eax, word [esp + 0xc]
mov ecx, dword [esp]
push ebp
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x4099ca
and word [esp + 8], 0
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor edi, edi
cmp eax, 1
sbb edi, edi
jmp 0x4099ca
xor edi, edi
dec edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4099d4
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x409a6e
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0xc]
and dword [eax + 0x12], 0
movups xmmword [eax], xmm0
and dword [eax + 0xe], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x409a6e
mov eax, dword [esp + 0x10]
mov dword [esp], eax
and word [esp], 0
mov eax, dword [esp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x409a6e
lea ebx, [esp + 8]
and dword [ebx], 0
movsx edi, word [esp + 0xc]
movsx eax, word [esp]
sub edi, eax
mov eax, dword [esp]
push ebx
push eax
push edi
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x409a6e
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], ecx
push ebx
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov ecx, eax
xor eax, eax
cmp ecx, 1
sbb eax, eax
jmp 0x409a71
xor eax, eax
dec eax
add esp, 0x24
pop esi
pop edi
pop ebx
ret
Function at 0x415530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x415541
jmp dword [eax*4 + 0x422058]
cmp dword [0x4241e8], 0
je 0x415643
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x424204]
test edi, edi
je 0x415638
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41558b
mov edi, dword [edi + 8]
test edi, edi
je 0x415638
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x415580
test esi, esi
je 0x415580
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x415580
cmp dword [0x4241e8], 0
jne 0x4155c0
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4241e8], 1
jmp case.default.0x415541
call fcn.00414cb0
jmp case.default.0x415541
cmp dword [0x4241e8], 0
je case.default.0x415541
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x424204]
test edi, edi
je 0x415693
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x415617
mov edi, dword [edi + 8]
test edi, edi
je 0x415693
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x415610
test esi, esi
je 0x415610
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x415610
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4241e8]
cmp eax, 1
jne case.default.0x415541
mov eax, dword [0x424204]
test eax, eax
je 0x415672
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x415660
mov dword [0x424204], 0
mov dword [0x4241e8], 0
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x415541
push 0x4241ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4157c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x41e004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x415826
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x415826
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x415826
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x415826
mov edx, dword [esp + 0xc]
sub edx, dword [0x41e004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x415816
add esi, 0x28
dec ecx
je 0x415826
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x415810
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x415810
mov eax, esi
pop esi
pop edi
ret
Function at 0x40d660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d6b8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x40d6b0
cmp ebp, ebx
jb 0x40d732
cmp ebp, dword [esp + 0x1c]
ja 0x40d743
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x40d6b2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x40d6a0
jmp 0x40d70f
ja 0x40d6b8
cmp edx, edi
mov ebx, ebp
jne 0x40d675
mov edx, dword [esp + 0x24]
test edx, edx
je 0x40d713
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x40d6f0
mov esi, edi
sub ecx, ebx
jns 0x40d707
jmp 0x40d715
cmp edi, edx
je 0x40d71c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x40d715
xor al, 1
cmp esi, edx
jne 0x40d6d0
jmp 0x40d715
xor eax, eax
jmp 0x40d715
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x45e79c
push 0x2b
push 0x45dc5d
call fcn.00451670
add esp, 0xc
ud2
push 0x45e78c
push ebp
push ebx
call fcn.00451a30
add esp, 0xc
ud2
push 0x45e78c
push dword [esp + 0x20]
push ebp
call fcn.00451a10
add esp, 0xc
ud2
Function at 0x412320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41afd0
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp edi, 0x201
jae 0x4123b0
jmp 0x41239e
jbe 0x412443
cmp edi, 0x201
jae 0x4123b0
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov esi, edi
jmp 0x4123eb
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x4123dc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, esi
push edi
call fcn.00451c90
add esp, 4
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x41240f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4124a6
cmp edi, esi
jne 0x412390
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4124c5
add esi, esi
mov eax, 0xffffffff
cmovb esi, eax
mov edi, esi
cmp edi, 0x201
jb 0x41239e
jmp 0x4123b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x4124e2
lea eax, [ebp - 0x48]
push edi
push ebx
push eax
call fcn.00413940
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x412490
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00442a00
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], 0
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x412480
jmp 0x412490
mov dword [ebp - 0x10], 0
push 0x460c6c
push 0x28
push 0x45f85f
call fcn.00451670
add esp, 0xc
jmp 0x4124f1
push 0x460c7c
push eax
push edi
call fcn.00451a10
add esp, 0xc
ud2
Function at 0x417d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41b170
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x49f024]
test eax, eax
je 0x417d54
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x417d6d
cmp dword [eax], 0
mov ebx, eax
je 0x417d6d
add ebx, 4
jmp 0x417e4b
push 0x49f024
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x417d45
mov eax, dword [0x49f024]
test eax, eax
je 0x417e2c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x417e49
mov edi, eax
test eax, eax
jne 0x417dda
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x49f024
push 4
push 0xc
call fcn.004429f0
add esp, 8
test eax, eax
je 0x417e70
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x49f024]
test eax, eax
je 0x417e5e
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
test esi, esi
je 0x417e08
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esi], 0
test eax, eax
je 0x417e08
cmp eax, 1
jne 0x417df8
mov edx, ecx
jmp 0x417e08
test ecx, ecx
je 0x417e08
lock dec dword [ecx]
jne 0x417e08
call fcn.00411370
xor edx, edx
mov ecx, dword [edi + 4]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], edx
je 0x417e4b
test ecx, ecx
je 0x417e4b
lock dec dword [ecx]
jne 0x417e4b
call fcn.00411370
jmp 0x417e4b
push 0x49f024
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x417d8b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x49f024
call fcn.00451f20
add esp, 4
jmp 0x417dd2
mov dword [ebp - 0x10], 0
push 4
push 0xc
call fcn.00451b50
add esp, 8
ud2