joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4551b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push reloc.WS2_32.dll_accept
lea ecx, [esp + 8]
call fcn.004108b0
mov esi, dword [esp + 0x30]
push 0
push 0x457828
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00402530
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410650
test eax, eax
lea ecx, [esp + 4]
je 0x418849
push 0
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
call fcn.00410970
push esi
push str.LastVersion
lea ecx, [esp + 0xc]
call fcn.00410a10
lea ecx, [esp + 4]
call fcn.00410770
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x418870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4551b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push reloc.WS2_32.dll_accept
lea ecx, [esp + 8]
call fcn.004108b0
mov esi, dword [esp + 0x30]
push 0
push 0x457828
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00402530
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410650
test eax, eax
lea ecx, [esp + 4]
je 0x4188f9
push 0
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
call fcn.00410970
push esi
push str.ShareFolderReg
lea ecx, [esp + 0xc]
call fcn.00410a10
lea ecx, [esp + 4]
call fcn.00410770
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x418920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4550a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push reloc.WS2_32.dll_accept
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.004108b0
mov esi, dword [esp + 0x34]
push 0
push 0x457828
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.00402530
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410650
test eax, eax
lea ecx, [esp + 4]
jne 0x418993
mov byte [esp + 0x28], al
call fcn.004108f0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
jmp 0x4189cd
push 0
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
call fcn.00410970
push esi
mov esi, dword [esp + 0x34]
push esi
lea ecx, [esp + 0xc]
call fcn.00410a10
lea ecx, [esp + 4]
call fcn.00410770
lea ecx, [esp + 4]
mov byte [esp + 0x28], 0
call fcn.004108f0
lea eax, [esi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4189ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x418a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4551e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push reloc.WS2_32.dll_accept
lea ecx, [esp + 8]
call fcn.004108b0
mov dword [esp + 0x28], 0
call fcn.0043e731
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp], eax
push 0xe
push str.UpdateCountLog
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.00402530
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410650
test eax, eax
jne 0x418a7f
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410710
push esi
push 0
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x14]
call fcn.00410970
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 4]
push eax
push esi
lea ecx, [esp + 0x10]
call fcn.00410790
lea ecx, [esp + 8]
call fcn.00410770
lea eax, [esi - 0x10]
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x418ad1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x418b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x455200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push reloc.WS2_32.dll_accept
lea ecx, [esp + 8]
call fcn.004108b0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov dword [esi], 0
call fcn.0043e731
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
push 0xe
push str.UpdateCountLog
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call fcn.00402530
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0xc]
call fcn.00410650
test eax, eax
jne 0x418b81
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
jmp 0x418bb1
push 0
push str.SoftwarePruna
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x10]
call fcn.00410970
push esi
mov esi, dword [esp + 0x34]
push esi
lea ecx, [esp + 0xc]
call fcn.00410840
lea ecx, [esp + 4]
call fcn.00410770
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418bcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x418ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x455294
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
mov dword [esp + 0xc], esi
mov dword [esi], 0x459e44
call fcn.0041bf90
lea edi, [esi + 0x60]
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.0041abc0
mov bl, 1
push 0xa
lea ecx, [esi + 0xac]
mov byte [esp + 0x1c], bl
call fcn.0043e044
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 2
call fcn.0041c560
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xf0], edi
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 4], bl
pop edi
mov dword [esi + 0x30], 0x418f20
mov dword [esi + 0x34], 0x418f50
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x419540
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455330
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0xc8], 0xff
push edi
mov dword [ebp - 0x10], esp
jne 0x41968e
mov eax, dword [esi + 0x48]
xor ebx, ebx
cmp eax, ebx
jne 0x419593
mov eax, dword [esi + 0xec]
mov ecx, dword [esi + 0x50]
cmp ecx, dword [eax + 0x14]
je 0x419593
push 0xffffffffffffff9a
mov ecx, esi
call fcn.00419300
mov eax, dword [esi + 0xec]
cmp word [eax + 0xe], 8
jne 0x4195a9
lea edx, [esi + 0x10]
push edx
call fcn.0041d310
mov edi, dword [ebp + 8]
cmp edi, ebx
mov byte [ebp - 0x11], 1
je 0x41964a
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
call fcn.0042dbbd
mov ecx, dword [esi + 0xec]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x144], eax
add esp, 4
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x140], edx
mov byte [ebp - 0x124], bl
call fcn.0041a480
mov ecx, dword [eax]
mov dword [ebp - 0x13c], ecx
mov edx, dword [eax + 4]
lea eax, [ebp - 0x144]
push eax
push edi
mov dword [ebp - 0x138], edx
call fcn.00445c89
mov eax, dword [esi + 0xec]
mov ecx, dword [eax + 0x2c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne byte [ebp - 0x11]
lea ecx, [esi + 0xcc]
mov dword [ebp - 4], 0xffffffff
call fcn.0041c880
lea ecx, [esi + 0x54]
mov byte [esi + 0xc8], bl
call fcn.0041bdd0
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419e70
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4553c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00402ca0
push 0x4595e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.00414140
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00419c10
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x2c], 1
mov dword [esp + 0x1c], 1
call fcn.0042ddb9
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x419efe
mov edx, dword [esp + 8]
push edx
call fcn.004191b0
add esp, 4
cmp eax, esi
je 0x419efe
xor bl, bl
jmp 0x419f00
mov bl, 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419f25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
mov eax, dword [esp + 8]
jne 0x419fbd
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00419c10
mov eax, dword [eax]
push eax
mov byte [esp + 0x28], 2
call fcn.00419e70
mov bl, al
mov eax, dword [esp + 0x1c]
add esp, 0xc
neg bl
sbb bl, bl
add eax, 0xfffffff0
inc bl
mov byte [esp + 0x1c], 0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419f76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
mov eax, dword [esp + 8]
jne 0x419f8f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [esp + 8]
jne 0x419fbd
add eax, 0xfffffff0
mov dword [esp + 0x1c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x419faa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
add eax, 0xfffffff0
mov dword [esp + 0x1c], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x419fd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41a320
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0041a2e0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
mov eax, dword [esp + 4]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41a361
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, bl
pop ebx
pop ecx
ret
Function at 0x41ae60
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4554d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [ecx + 0xc]
push ebx
add ecx, 0xc
lea edx, [esp + 8]
push edx
call dword [eax + 0x18]
mov eax, dword [eax]
push eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], 0
call fcn.0041a2e0
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, eax
mov eax, dword [esp + 4]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aee2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41af08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
pop ebx
je 0x41af1e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x41c560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4556a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x459e9c
call fcn.0043e731
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
lea edi, [esi + 0x38]
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.0043e2c0
mov dword [edi], method.CPtrArray.virtual_0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.0041bda0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0x8000
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41cac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x455658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x24]
push ebp
push esi
lea ecx, [eax + 0xc]
mov eax, dword [ecx]
mov esi, 0x10015
push edi
mov dword [esp + 0x18], esi
call dword [eax + 0x30]
cmp eax, esi
mov dword [esp + 0x1c], eax
jae 0x41cb00
mov esi, eax
mov dword [esp + 0x18], esi
mov ecx, dword [ebx + 0x30]
push 0
push ecx
lea ecx, [esp + 0x28]
call fcn.0041bef0
xor eax, eax
test esi, esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x14], eax
jle 0x41cbad
mov edi, dword [ebx + 0x30]
add edi, eax
cmp edi, esi
jle 0x41cb30
mov edi, esi
mov esi, edi
sub esi, eax
mov eax, dword [ebx + 0x24]
mov ebp, dword [eax + 0xc]
lea ecx, [eax + 0xc]
mov eax, edi
neg eax
cdq
push 2
push edx
push eax
call dword [ebp + 0x28]
mov edx, dword [ebx + 0x24]
mov ebp, dword [edx + 0xc]
push esi
lea ecx, [esp + 0x24]
call fcn.0041be80
mov ecx, dword [ebx + 0x24]
push eax
add ecx, 0xc
call dword [ebp + 0x34]
lea eax, [esi - 4]
test eax, eax
mov dword [esp + 0x10], eax
jl 0x41cb95
mov edi, edi
lea ecx, [esp + 0x20]
mov ebp, 0x46b1c8
call fcn.0041be80
mov ecx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [ecx + eax]
add ecx, eax
cmp edx, dword [ebp]
je 0x41cbdc
dec eax
mov dword [esp + 0x10], eax
jns 0x41cb70
mov eax, dword [esp + 0x14]
lea eax, [eax + esi - 3]
mov esi, dword [esp + 0x18]
cmp edi, esi
mov dword [esp + 0x14], eax
jl 0x41cb25
push 0xffffffffffffff9b
mov ecx, ebx
call fcn.0041c670
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0xffffffff
call fcn.0041bf20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, dword [esp + 0x1c]
sub eax, edi
add eax, ecx
lea ecx, [esp + 0x20]
mov esi, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.0041bf20
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x41d920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x41d92f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x46b244]
test eax, eax
je 0x41d93d
call fcn.0041d8c0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x41da3f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x46fe60]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x46fe60]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x46fe60]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x46fe60]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x46fe60]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x46fe60]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x46fe60]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x46fe60]
xor eax, ecx
inc esi
dec edi
jne 0x41d957
pop edi
test edx, edx
je 0x41da61
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x46fe60]
xor eax, ecx
inc esi
dec edx
jne 0x41da43
pop ebx
pop esi
not eax
ret 0xc
Function at 0x423510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x423563
call fcn.0044f73f
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x423563
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x423559
xor eax, eax
jmp 0x42367c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x423593
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x423593
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x423679
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x4235c0
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00418fd0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x423679
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x423609
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x423609
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x423603
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00418fd0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x423669
and dword [ebp + 0xc], 0
jmp 0x423669
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x423669
push 0xc
call fcn.0043eb95
mov esi, eax
test esi, esi
pop ecx
je 0x42364b
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x42364d
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x423664
push dword [ebp - 8]
call fcn.0043e11b
jmp 0x423669
call fcn.0043e0f2
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x4235ce
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42ec28
Capabilities:
Terminate process

Disassembly:
push 8
push 0x45fba0
call fcn.00430c78
push 8
call fcn.0043242e
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4722b4], esi
jne 0x42ec5c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4722b0], esi
mov al, byte [ebp + 0x10]
mov byte [0x4722ac], al
cmp dword [ebp + 0xc], edi
jne 0x42eca6
cmp dword [0x473b4c], edi
je 0x42ec96
mov eax, dword [0x473b48]
sub eax, 4
mov dword [0x473b48], eax
cmp eax, dword [0x473b4c]
jb 0x42ec96
mov eax, dword [eax]
cmp eax, edi
je 0x42ec77
call eax
jmp 0x42ec77
push 0x46b0b8
mov eax, 0x46b0b0
call fcn.0042eba6
pop ecx
push 0x46b0c4
mov eax, 0x46b0bc
call fcn.0042eba6
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x42ecd7
cmp dword [ebp + 0x10], edi
jne 0x42ece5
mov dword [0x4722b4], esi
push dword [ebp + 8]
call fcn.0042eb64
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x42ece4
push 8
call fcn.00432379
pop ecx
ret
call fcn.00430cb3
ret

Function at 0x42f34e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0042ef50
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42f3e9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x472274]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x42f3e9
cmp eax, 1
je 0x42f40a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42f3e9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x42f3b6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42f3e5
xor eax, eax
inc eax
jmp 0x42f429
cmp edi, eax
jae 0x42f3ed
xor eax, eax
jmp 0x42f429
cmp eax, esi
jae 0x42f3f4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x472274]
jmp 0x42f40d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42fa9a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42faba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00430cea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x42fadd
test byte [esp + 8], 2
je 0x42fadd
call fcn.00430cd8
mov dword [eax], 0xd
call fcn.00430ce1
mov dword [eax], 5
jmp 0x42fab6
xor eax, eax
ret