joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
lea eax, [edi + 0xcf740]
push dword [eax]
mov dword [eax], 0x219ce558
push eax
push edi
jmp 0x54829a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5482a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548290
mov eax, 1
add ebx, ebx
jne 0x5482b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5482c4
jne 0x5482e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5482e3
dec eax
add ebx, ebx
jne 0x5482d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5482a8
add ebx, ebx
jne 0x5482df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x548335
xor ecx, ecx
sub eax, 3
jb 0x5482fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54836a
sar eax, 1
mov ebp, eax
jmp 0x548306
add ebx, ebx
jne 0x548306
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5482d4
inc ecx
add ebx, ebx
jne 0x548314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5482d4
add ebx, ebx
jne 0x548321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x548316
jne 0x548332
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x548316
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x548354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x548346
jmp 0x548296
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x548354
add edi, ecx
jmp 0x548296
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x548376
cmp byte [edi], 0x11
jne 0x548376
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54837b
lea edi, [esi + 0x141000]
mov eax, dword [edi]
or eax, eax
je 0x5483f3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x148f98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14913c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5483a8
mov ecx, edi
jns 0x5483d7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x149144]
or eax, eax
je 0x5483ed
mov dword [ebx], eax
add ebx, 4
jmp 0x5483c5
call dword [esi + 0x149140]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x548424
cmp al, 0xef
ja 0x548417
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5483f9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x548406
mov ebp, dword [esi + 0x149148]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x548458
sub esp, 0xffffff80
jmp 0x420577
Function at 0x6225ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x6225ed
lcall 0x5de5, 0x8b10c483
jmp loc.0153e850
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a0d93
Capabilities:
Encode data using xor

Disassembly:
shr ecx, 1
call fcn.005a1b79
mov word [eax + 0x4e], gs
invalid

Function at 0x5ae517
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0xc768
call fcn.004f2958
mov ecx, edi
pop esi
sub ecx, ebx
shl si, 4
mov esi, esp
bt ax, ax
sub edi, 4
pushal
mov byte [esp + 0xc], cl
clc
push dword [edi]
pop dword [esp + 0x1c]
push dword [esp]
mov word [esp], si
cmp edi, ebx
jmp 0x5ad9b8
Function at 0x401a0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x401a2b
xor eax, eax
jmp 0x401b51
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x401a4a
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x401a4e
inc esi
cmp esi, ecx
jb 0x401a41
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x401b3e
cmp ecx, 2
jbe 0x401ad8
xor edx, edx
movzx ecx, byte [esi + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x401b32
movzx eax, byte [esi + 3]
mov ebx, dword [ebp + 0x10]
shl ecx, 8
add ebx, edi
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
add ecx, ebx
sub eax, ebx
cmp dword [ebp + 0x18], 0
cmove ecx, eax
mov dword [ebp - 4], ecx
mov ebx, ecx
test edx, edx
je 0x401b0c
and edx, 6
mov eax, ecx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x401b0a
mov eax, dword [ebp + 0x10]
mov ebx, 0x100
shl ebx, cl
add eax, edi
dec ebx
xor ebx, dword [ebp - 4]
cmp dword [ebp + 0x18], 0
je 0x401b08
add ebx, eax
jmp 0x401b0a
shr edx, cl
test edx, edx
je 0x401a68
cmp edx, 4
ja 0x401afa
cmp edx, 3
je 0x401afa
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x401a68
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x401a3c
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
mov ebx, dword [ebp + 8]
pop eax
jmp 0x401b3a
or edx, 8
xor eax, eax
shr edx, 1
inc eax
add edi, eax
jmp 0x401b00
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
leave
ret 0x14
Function at 0x402081
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x474034]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4020c1
cmp dword [ebp - 0x364], 6
jne 0x4020c1
cmp dword [ebp - 0x360], 0
je 0x4020eb
push str.SetDefaultDllDirectories
push 0x463448
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4020eb
push 0xc00
call eax
test eax, eax
jne 0x402180
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402180
cmp eax, 0x104
ja 0x402180
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x40212b
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x40217f
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402146
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402144
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421722
leave
ret
Function at 0x40593b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x4059e5
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x4059c6
push edi
call fcn.00405910
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x4059b9
cmp dword [esi + 0x5c], ebx
je 0x4059e0
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.00405e2a
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.004058d2
mov edi, eax
test edi, edi
jne 0x405a61
lea eax, [ebx + 0x20]
push eax
call fcn.004069c1
mov edi, eax
test edi, edi
jne 0x405a61
lea eax, [ebx + 0x1c]
push eax
call fcn.004069c1
mov edi, eax
test edi, edi
jne 0x405a61
push ebx
call fcn.00406866
mov edi, eax
test edi, edi
je 0x405a61
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.0040584d
add ebx, 0x28
sub esi, 1
jne 0x405a50
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x405a75
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x405a89
cmp dword [esi + 0x40], edx
jne 0x405a89
cmp dword [esi + 0x3c], edx
jne 0x405a89
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x406acb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.0042e348
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x406af7
call fcn.004069e0
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x40bb3a
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x460cbc
call fcn.004219f1
cmp byte [0x475848], 0
mov edi, dword [ebp + 8]
jne 0x40bb76
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.004091d2
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
jmp 0x40bb82
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bb88
mov al, 1
jmp 0x40bbcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bb99
xor al, al
jmp 0x40bbcd
lea ecx, [ebp - 0x50]
call fcn.0040c648
lea ecx, [ebp - 0x28]
call fcn.00407936
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c861
test al, al
je 0x40bbc2
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.004219a7
pop ecx
mov al, bl
call fcn.004219ba
ret 4

Function at 0x40bbd5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x475848], 0
jne 0x40bc0b
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
pop esi
jmp 0x40bc18
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc1e
mov al, 1
jmp 0x40bc20
xor al, al
leave
ret 4

Function at 0x40bdeb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040ce79
cmp eax, 0xffffffff
je 0x40be18
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40be18
and eax, 0xfffffffe
push eax
push esi
call fcn.0040c532
test al, al
je 0x40be50
cmp byte [0x475848], 0
push esi
jne 0x40be42
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
jmp 0x40be4a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40be50
mov al, 1
jmp 0x40be52
xor al, al
pop esi
leave
ret 4

Function at 0x40c2bd
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x475848], 0
jne 0x40c2f1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
pop esi
jmp 0x40c2fc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40c302
mov al, 1
jmp 0x40c304
xor al, al
leave
ret 4
Function at 0x40c48c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x475848], 0
jne 0x40c4c0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
pop esi
jmp 0x40c4cb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x40c532
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x475848], 0
jne 0x40c569
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
test esi, esi
pop esi
jmp 0x40c577
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40c57d
mov al, 1
jmp 0x40c57f
xor al, al
leave
ret 8

Function at 0x40ce79
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x475848], 0
jne 0x40cead
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004091d2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004219a7
pop ecx
mov eax, esi
pop esi
jmp 0x40cec0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4

Function at 0x40d27e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d2a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d2a4
xor al, al
jmp 0x40d2b8
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x41ff81
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462719
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x474034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041efe5
lea ecx, [esi + 0x30]
call fcn.0041cdaf
push dword [esi + 0x24]
call fcn.004219a7
pop ecx
lea ecx, [esi + 0xc]
call fcn.00406b57
mov ecx, esi
call fcn.0041ff47
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x420659
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x462837
call fcn.004219f1
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.004201d8
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0040e693
push dword [ebp - 0x18]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040edf0
push dword [ebp - 0x18]
call fcn.004219a7
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.004219ba
ret 8
Function at 0x4483c4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00448298

Function at 0x44b0c0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044aa78
Function at 0x401002
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, 0
push edx
call dword [sym.imp.user32.dll_GetKeyState]
mov dword [0x4161ea], eax
push 0
pop eax
xor edx, edx
push edx
call dword [sym.imp.user32.dll_GetKeyState]
mov dword [0x41665d], eax
push 0
pop eax
mov ebx, edi
sub ebx, 0xd07
inc ebx
mov ecx, ebx
sub ecx, edi
add ecx, dword [0x416523]
mov eax, ecx
shr eax, 5
add eax, esi
sub eax, 0x54f
mov edx, eax
sub dword [0x416b4e], edx
lea edx, [eax + 0x416c89]
add edx, dword [0x416811]
shr edx, 6
mov eax, edx
rol eax, 7
sub eax, dword [0x4163c5]
mov edx, eax
add edx, 0x803
inc edx
ror edx, 4
sub edx, edi
sub dword [0x416006], edx
call fcn.00402e08
mov dword [0x4165ac], eax
mov ecx, 0x30
push ecx
mov dword [0x416379], 0
mov ebx, dword [0x416379]
push ebx
mov esi, dword [sym.imp.GDI32.DLL_GetRasterizerCaps]
call esi
xor ebx, ebx
add ebx, 0xf6a
ja 0x4010b8
ror ebx, 1
shl ebx, 6
sub ebx, eax
add ebx, edi
add ebx, 0x288
shr ebx, 2
sub ebx, 0x34
dec ebx
ror ebx, 1
sub dword [0x4160eb], ebx
ret
Function at 0x40b930
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40bafe
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b95b
mov eax, 0x7000000
jmp 0x40b963
test eax, eax
je 0x40bad9
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00462670
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x8260c0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40baf1
cmp ecx, 0x21
jae 0x40bae5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045d160
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045d230
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x6c2e38]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x6c2f28]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bab4
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x6c2fc0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00462750
mov eax, ecx
mov ecx, 0x21
call fcn.00462820
nop
call fcn.004612b0
jmp fcn.0040b930