joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x41a8d1
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x41a8d1
mov edx, dword [0x4e899c]
cmp edx, 2
jne 0x41a765
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.0041aab0
add esp, 4
call fcn.0041b010
cmp byte [esp + 0x24], 0
je 0x41a8d1
mov dword [esi], connect
mov dword [ebp], connect
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x41a7ba
cmp edx, 1
jne 0x41a7a0
cmp dword [0x4e6da8], 0x80000000
jne 0x41a78e
push 0x4e6da8
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4e6da8]
add dword [esi], eax
mov ecx, dword [0x4e6dac]
add dword [ebp], ecx
jmp 0x41a7df
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x41a7df
mov edx, dword [0x4e4b24]
movzx eax, word [edx + 0xf0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x41a7df
push eax
mov edi, ebp
mov ebx, esi
call fcn.0049f990
add esp, 4
cmp dword [0x4e899c], 1
jne 0x41a7f8
mov eax, dword [esi]
mov dword [0x4e6da8], eax
mov ecx, dword [ebp]
mov dword [0x4e6dac], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x41a8bb
cmp eax, 0x64
jle 0x41a853
mov dword [esp + 0x20], 0x64
jmp 0x41a857
test eax, eax
je 0x41a8bb
cmp dword [0x4e899c], 1
je 0x41a8bb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.00473940
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.0041a8e0
add esp, 4
call fcn.0041b010
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41ad10
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 8
mov eax, dword fs:[0x24]
push ebx
push esi
mov esi, 1
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp dword [0x4e899c], esi
jne 0x41ae97
xor al, al
mov byte [esp + 8], al
cmp dword [0x4e8020], ebx
je 0x41ad49
mov byte [esp + 8], 1
mov al, byte [esp + 8]
cmp dword [0x4e8024], ebx
je 0x41ad57
or al, 2
mov byte [esp + 8], al
cmp al, bl
je 0x41ad72
mov cl, byte [0x4e6da6]
not cl
and cl, al
movzx edx, cl
push esi
push edx
call fcn.00412620
add esp, 8
mov eax, dword [0x4e6dbc]
push ebp
mov ebp, dword [0x4e6db8]
push edi
xor ecx, ecx
xor edi, edi
cmp ebp, ebx
jbe 0x41ae13
xor esi, esi
xor edx, edx
nop
cmp dword [esi + eax], 1
jne 0x41ae07
cmp word [esi + eax + 4], bx
jne 0x41ae07
cmp word [esi + eax + 6], bx
jne 0x41ae07
add edx, eax
push 0x1c
mov eax, edi
push edx
sub eax, ecx
push eax
call dword [0x4eaea4]
mov ecx, dword [esp + 0x14]
cmp dword [0x4ea158], ecx
mov ecx, dword [0x4e6dbc]
mov dword [0x4e4a2c], ebx
je 0x41addd
mov eax, dword [esi + ecx + 0x10]
cmp eax, ebx
jl 0x41addd
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41adec
mov edx, dword [esi + ecx + 0x10]
push 1
push edx
call fcn.00401510
add esp, 8
mov ebp, dword [0x4e6db8]
mov eax, dword [0x4e6dbc]
mov dword [0x4e4a2c], 1
lea ecx, [edi + 1]
lea edx, [esi + 0x1c]
inc edi
add esi, 0x1c
cmp edi, ebp
jb 0x41ad90
cmp ecx, ebx
jne 0x41ae19
push 0x1c
push eax
push ebp
jmp 0x41ae29
lea edx, [ecx*8]
sub edx, ecx
push 0x1c
lea eax, [eax + edx*4]
push eax
push ecx
call dword [0x4eaea4]
mov al, byte [esp + 0x10]
pop edi
pop ebp
cmp al, bl
je 0x41af05
mov cl, byte [0x4e6da6]
and cl, al
test cl, 1
je 0x41ae7d
push 1
call fcn.0041b9f0
mov dl, byte [esp + 0x1c]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4e7eeb]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4e7eeb], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4e6bb8], eax
mov edx, dword [esp + 8]
pop esi
pop ebx
add esp, 8
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.00412620
push ebx
push ebx
mov dword [0x4e6db0], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4191e0
push esi
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4e8028], eax
cmp eax, ebx
je 0x41af05
mov byte [0x4e8010], 1
push esi
push 0x8000012f
mov dword [0x4e4a2c], ebx
call fcn.00401510
add esp, 8
mov dword [0x4e4a2c], esi
cmp dword [0x4e8028], ebx
jne 0x41aec2
mov eax, dword [0x4e6dbc]
mov ecx, dword [0x4e6db8]
mov byte [0x4e8010], bl
cmp dword [eax + ecx*8 - 8], ebx
jne 0x41af05
mov eax, dword [eax + ecx*8 - 4]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
pop esi
pop ebx
add esp, 8
ret
Function at 0x41b120
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4e8934]
test eax, eax
je 0x41b238
mov ecx, dword [0x4e8938]
imul ecx, ecx, 0xd4
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 6], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov ecx, 0x69
mov word [eax + 2], dx
push esi
mov word [eax + 4], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4eae94]
mov dword [0x4e893c], eax
mov dword [esp + 4], edx
fild dword [esp + 4]
jns 0x41b17b
fadd dword [0x4de808]
fdiv qword [0x4de800]
mov ecx, dword [0x4e8938]
mov edx, dword [0x4e8934]
mov dword [0x4eae94], eax
imul ecx, ecx, 0xd4
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [ecx + edx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x41b1e8
mov eax, dword [0x4e8938]
imul eax, eax, 0xd4
cmp esi, dword [0x4e8940]
je 0x41b1d9
mov ecx, dword [0x4e8934]
push 0x64
lea edx, [eax + ecx + 0xc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41b214
mov edx, dword [0x4e8934]
xor ecx, ecx
mov word [eax + edx + 0xc], cx
jmp 0x41b214
mov ecx, dword [0x4e8938]
mov edx, dword [0x4e8934]
imul ecx, ecx, 0xd4
mov eax, 0x4beeec
lea edx, [ecx + edx + 0xc]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41b205
mov eax, dword [0x4e8938]
inc eax
mov dword [0x4e8940], esi
mov dword [0x4e8938], eax
pop esi
cmp eax, dword [0x4e4a30]
jl 0x41b238
mov dword [0x4e8938], 0
pop ecx
ret

Function at 0x41b240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
movzx edi, bl
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
movsx esi, al
neg esi
sbb esi, esi
add esi, 2
cmp ebp, 1
je 0x41b26b
cmp ebp, 2
jne 0x41b341
cmp esi, ebp
je 0x41b341
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
mov ecx, 0x8000
test cx, ax
je 0x41b29c
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 1
call fcn.00419440
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 2
call fcn.00419440
add esp, 0x18
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4ea158]
sete al
mov byte [esp + 0x10], al
test al, al
je 0x41b2f2
push 1
push 0xffffffffffffffff
mov dword [0x4e4a2c], 0
call fcn.00401510
add esp, 8
mov dword [0x4e4a2c], 1
cmp bl, 0x14
jne 0x41b341
cmp ebp, 2
jne 0x41b341
push 0x14
call edi
test al, 1
je 0x41b341
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push ebp
call fcn.00419440
add esp, 0x18
cmp byte [esp + 0x10], 0
je 0x41b341
push 1
push 0xffffffffffffffff
mov dword [0x4e4a2c], 0
call fcn.00401510
add esp, 8
mov dword [0x4e4a2c], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x41b9f0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x4e8020], 0
je 0x41ba06
cmp byte [esp + 4], 0
jne 0x41ba06
mov al, byte [0x4e7ee7]
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x41ba23
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x41ba37
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x41ba4b
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x41ba5f
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x41ba73
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x41ba87
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x41ba98
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x41baa9
or bl, 0x80
cmp dword [0x4e8020], 0
je 0x41bae6
mov al, bl
not al
and al, byte [0x4e7ee7]
je 0x41bae6
mov cl, byte [0x4e7eeb]
not al
and byte [0x4e7ee7], al
and byte [0x4e7eea], al
and cl, al
mov al, cl
mov byte [0x4e7eeb], cl
mov ecx, 0x4e7f10
call fcn.0041baf0
pop esi
mov al, bl
pop ebx
ret

Function at 0x41bfd0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x34
push esi
xor esi, esi
push edi
test eax, eax
je 0x41c00e
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x41c00e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41c00e
push 0
push eax
call edi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
pop edi
pop esi
add esp, 0x34
ret

Function at 0x41c020
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x284
push ebx
push ebp
xor ebp, ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ebx, eax
test ebx, ebx
je 0x41c0cf
xor eax, eax
jmp 0x41c050
movzx ecx, word [eax + str.SYSTEMCurrentControlSetControlKeyboard_Layouts_]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x41c050
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x41c0bd
lea edx, [esp + 8]
push edx
push 1
push 0
lea eax, [esp + 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c0bd
push esi
push edi
lea edi, [esp + 0x10]
lea esi, [esp + 0x8c]
mov ecx, str.Layout_File
call fcn.0049fa80
pop edi
pop esi
test eax, eax
je 0x41c0bd
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp dword [esp + 0x290], ebx
je 0x41c0cf
push 0
push ebx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov eax, ebp
pop ebp
pop ebx
add esp, 0x284
ret
Function at 0x41c2a0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push ebp
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov al, byte [esp + 0x11c]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x41c39c
push ebx
push esi
push 0x100
lea edx, [esp + 0x24]
push 0
push edx
call sub.MSVCR100.dll_memset
mov ebx, dword [sym.imp.USER32.dll_ToUnicodeEx]
add esp, 0xc
push ebp
xor esi, esi
push esi
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
push 0x6e
call ebx
cmp eax, 2
jne 0x41c2ff
movzx esi, word [esp + 0x10]
movzx ecx, byte [esp + 0x124]
push ebp
push 0
push 2
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
call ebx
mov dword [esp + 0x1c], eax
test eax, eax
jns 0x41c338
push ebp
push 0
push 2
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0x6e
call ebx
test si, si
je 0x41c37c
push edi
push 1
push ebp
lea edi, [esp + 0x1b]
call fcn.0041c570
add esp, 8
mov byte [esp + 0x12], al
pop edi
test al, al
je 0x41c37c
mov al, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0041baf0
movzx eax, byte [esp + 0xe]
push ebp
push 0
push 2
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push eax
call ebx
cmp dword [esp + 0x1c], 0
pop esi
pop ebx
je 0x41c392
movzx eax, word [esp + 8]
pop ebp
add esp, 0x114
ret
xor eax, eax
pop ebp
add esp, 0x114
ret
push ebp
movzx ecx, al
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
pop ebp
add esp, 0x114
ret

Function at 0x41c570
Capabilities:
Log keystrokes via polling

Disassembly:
cmp si, 0xa
jne 0x41c579
mov al, 0xd
ret
mov eax, dword [esp + 4]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov ecx, eax
shr ecx, 8
mov bl, al
cmp cl, 0xff
jne 0x41c5d7
cmp al, 0xff
jne 0x41c5d7
cmp byte [esp + 0xc], 0
je 0x41c5dc
movzx eax, si
test eax, 0xffffff80
jne 0x41c5dc
push 0x103
push eax
call dword [sym.imp.MSVCR100.dll__isctype]
add esp, 8
test eax, eax
je 0x41c5dc
mov eax, esi
call fcn.00413020
mov bl, al
mov ecx, 1
mov eax, esi
call fcn.00405570
test eax, eax
setne cl
test cl, 0x38
je 0x41c5e0
xor al, al
pop ebx
ret
test edi, edi
je 0x41c620
mov dl, cl
and dl, 6
cmp dl, 6
jne 0x41c5f3
or byte [edi], 8
jmp 0x41c611
test cl, 2
je 0x41c602
mov al, byte [edi]
test al, 3
jne 0x41c602
or al, 1
mov byte [edi], al
test cl, 4
je 0x41c611
mov al, byte [edi]
test al, 0xc
jne 0x41c611
or al, 4
mov byte [edi], al
test cl, 1
je 0x41c620
mov al, byte [edi]
test al, 0x30
jne 0x41c620
or al, 0x10
mov byte [edi], al
mov al, bl
pop ebx
ret
Function at 0x41cd20
Capabilities:
Log keystrokes

Disassembly:
movzx ecx, bx
mov eax, ecx
cmp eax, 0x11c
jg 0x41cd7d
je 0x41cd7a
sub eax, 0x1d
cmp eax, 0x36
ja case.0x41cd8e.286
movzx eax, byte [eax + 0x41ce28]
jmp dword [eax*4 + 0x41cddc]
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, 0xc
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, 0x23
ret
mov al, 0x21
ret
mov al, 0x22
ret
mov al, 0x13
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x41cd8e.286
movzx edx, byte [eax + 0x41ce88]
jmp dword [edx*4 + 0x41ce60]
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x5b
ret
mov al, 0x5c
ret
mov al, 0x90
ret
mov al, 0x6f
ret
mov al, 0x5d
ret
mov al, 0x2c
ret
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
test ebx, 0x100
je 0x41cdd0
movzx eax, cl
push 1
or eax, 0xe000
push eax
call esi
test eax, eax
jne 0x41cdd8
movzx ecx, bl
push 1
push ecx
call esi
pop esi
ret
Function at 0x41ea40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
not eax
cmp edx, 8
jb 0x41eb0f
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4d0b98]
add ecx, 8
sub edx, 8
dec esi
jne 0x41ea52
pop edi
test edx, edx
je 0x41eb2c
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4d0b98]
inc ecx
dec edx
jne 0x41eb13
not eax
pop esi
ret

Function at 0x41ef20
Capabilities:
Read file on windows

Disassembly:
push ecx
test byte [esi], 1
push edi
mov edi, eax
jne 0x41ef51
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 8]
push eax
push edi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ef4a
mov dword [esi + 8], 7
pop edi
pop ecx
ret
mov eax, dword [esp + 4]
pop edi
pop ecx
ret
xor eax, eax
mov ecx, edi
add ecx, dword [esi + 0x18]
adc eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x14]
jb 0x41ef6d
ja 0x41ef67
cmp ecx, dword [esi + 0x10]
jbe 0x41ef6d
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0x18]
mov eax, dword [esi + 4]
add eax, dword [esi + 0x18]
push edi
push eax
push edx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
pop edi
adc dword [esi + 0x1c], 0
pop ecx
ret
Function at 0x4202a0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
cmp byte [ecx], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov ebp, ecx
je 0x4202cf
cmp byte [ecx + 1], 0x3a
jne 0x4202cf
add ecx, 2
cmp byte [ecx], 0x5c
jne 0x4202d5
inc ecx
mov al, byte [ecx]
test al, al
je 0x420304
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 0x5c
je 0x4202f7
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4202e7
xor esi, esi
jmp 0x4202fd
mov esi, ecx
test ecx, ecx
jne 0x420311
cmp dword [esp + 0x20], 0
jne 0x420314
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov byte [ecx], 0
lea eax, [esp + 0x10]
push eax
push ebp
call edi
test eax, eax
jne 0x420329
call ebx
cmp eax, 0xb7
jne 0x420346
test esi, esi
je 0x420304
lea ecx, [esi + 1]
mov byte [esi], 0x5c
mov al, byte [ecx]
test al, al
jne 0x4202e7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
test esi, esi
je 0x42034d
mov byte [esi], 0x5c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x420450
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, edx
push 1
push edi
mov ebx, eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x420666
mov eax, dword [edi + 0x30]
and eax, dword [edi + 0x34]
cmp eax, 0xffffffff
je 0x420666
mov eax, dword [esp + 0x1c]
mov dword [edi + 8], 0
test al, 1
je 0x4204ff
cmp word [edi + 0x70], 0
jne 0x4204af
mov eax, ebx
mov ecx, edi
call fcn.0041f770
cmp dword [edi + 8], 0
jne 0x420654
mov ecx, 1
mov word [edi + 0x70], cx
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x28]
push edx
push eax
push esi
call fcn.0041fa60
add esp, 0xc
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], edx
cmp dword [edi + 8], 0
jne 0x4204e7
mov ecx, dword [edi + 0xe8]
or ecx, dword [edi + 0xec]
je 0x4204e7
mov eax, 5
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edx, edx
mov esi, edi
mov word [edi + 0x70], dx
call fcn.0041f710
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test byte [ebx + 8], 0x10
je 0x420530
test al, 2
je 0x420526
push 1
test eax, eax
jns 0x420518
mov eax, esi
call fcn.00420360
jmp 0x42051f
mov ecx, esi
call fcn.004202a0
add esp, 4
test eax, eax
je 0x420597
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 4
jne 0x420539
mov ebp, esi
jmp 0x420592
mov ebp, eax
and ebp, 0x80000000
push 0
je 0x42054e
mov eax, esi
call fcn.00420360
jmp 0x420555
mov ecx, esi
call fcn.004202a0
add esp, 4
test eax, eax
je 0x420597
push 0
test ebp, ebp
je 0x42057a
mov eax, dword [ebx + 8]
push eax
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x420590
mov ecx, dword [ebx + 8]
push ecx
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4205b0
mov esi, edi
mov dword [edi + 8], 1
call fcn.0041f710
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebx
mov ecx, edi
call fcn.0041f770
cmp dword [edi + 8], 0
jne 0x420646
cmp dword [edi + 0x4c], 0
jne 0x4205e4
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x4205e4
mov dword [edi + 8], 2
cmp dword [edi + 8], 0
jne 0x420646
mov edx, dword [edi + 0x4c]
push 0
push 0x4000
push edx
call fcn.0041fa60
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42062d
mov ecx, dword [edi + 0x4c]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x420620
cmp dword [esp + 0x14], esi
je 0x420627
mov dword [edi + 8], 3
cmp dword [edi + 8], 0
je 0x4205ea
cmp dword [edi + 8], 0
jne 0x420646
lea edx, [ebx + 0x1c]
push edx
lea eax, [ebx + 0xc]
push eax
add ebx, 0x14
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [esp + 0x1c], 4
je 0x420654
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.0041f710
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
add esp, 8
ret
Function at 0x420f10
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, eax
mov ecx, dword [esi + 0x64]
push edi
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x420f39
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
mov eax, dword [esp + 0x24]
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x420f4b
mov ebp, 1
test al, 2
je 0x420f52
or ebp, 2
test al, 4
je 0x420f59
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x420f63
or ebp, 0x10
test al, 0x20
je 0x420f6a
or ebp, 0x20
test ecx, ecx
je 0x420f76
or ebp, 0x40000000
jmp 0x420f7c
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x420f8c
or ebp, 0x800000
mov edx, dword [esi + 0x64]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
ja 0x420fab
cmp eax, 0x28
jbe 0x421072
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
jne 0x421072
mov ecx, dword [esi + 0x64]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push eax
push eax
push ecx
call edi
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x1c]
push edx
push 2
lea eax, [esp + 0x20]
push eax
push ecx
call ebx
mov edx, dword [esi + 0x64]
push 0
push 0
push 0x24
push edx
call edi
mov edx, dword [esi + 0x64]
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push edx
call ebx
mov eax, 0x54ad
cmp word [esp + 0x14], ax
jne 0x421066
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp dword [esi + 0x54], ecx
jb 0x421066
ja 0x421021
lea ecx, [eax + 0x34]
cmp dword [esi + 0x50], ecx
jbe 0x421066
push 0
push 0
push eax
mov eax, dword [esi + 0x64]
push eax
call edi
mov eax, dword [esi + 0x64]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push eax
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x421060
cmp eax, 0x454e
je 0x421060
cmp eax, 0x454c
je 0x421060
cmp eax, 0x4550
jne 0x421066
or ebp, 0x400000
mov ecx, dword [esi + 0x64]
push 0
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x5c]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
mov dword [ebx + 0x10], ebp
call fcn.004b9cd0
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
push 0
mov ecx, esi
sub ecx, 0xd53e8000
mov edx, edi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebx], eax
call fcn.004b9cd0
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.004b9cd0
push edi
push esi
lea edx, [esp + 0x20]
mov dword [ebx + 8], eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00420e30
movzx ecx, word [esp + 0x24]
movzx edx, word [esp + 0x28]
add esp, 0x10
pop edi
shl ecx, 0x10
pop esi
or ecx, edx
pop ebp
mov dword [ebx + 0xc], ecx
xor eax, eax
pop ebx
add esp, 0x48
ret