joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf68
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00439600
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0044d034
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x45cfaa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x45d106
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0045c6c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47d450]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00459851
mov ecx, dword [esi*4 + 0x47d450]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x45d0ff
cmp eax, dword [ecx + edi + 0x24]
jne 0x45d0ff
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45d0ff
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00459851
add esp, 0x14
test edx, edx
jl 0x45d0ff
jg 0x45d075
test eax, eax
jb 0x45d0ff
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x45d0ff
jl 0x45d08f
cmp dword [ebp - 0x1008], eax
ja 0x45d0ff
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x45d0ad
test ebx, ebx
je 0x45d0e6
cmp ecx, edi
jae 0x45d0e6
mov al, byte [ecx]
cmp al, 0xd
jne 0x45d0c7
lea eax, [edi - 1]
cmp ecx, eax
jae 0x45d0d3
cmp byte [ecx + 1], 0xa
jne 0x45d0d3
inc ecx
jmp 0x45d0d3
movzx eax, al
movsx eax, byte [eax + 0x47b9d0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x45d0ad
cmp edx, ebx
jne 0x45d0ad
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x45d104
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00438436
leave
ret
Function at 0x461892
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0046180e
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x461a01
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x461a01
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4619b6
jg 0x4618ee
test eax, eax
je 0x4619ac
push 1
push 0x1000
call fcn.0044f343
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x461911
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4619a3
push 0x8000
push ebx
call fcn.0044a723
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46193a
jg 0x461935
cmp ecx, 0x1000
jb 0x46193a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00458a25
add esp, 0x10
cmp eax, 0xffffffff
je 0x46197f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x461935
jl 0x461966
test ecx, ecx
jne 0x461927
push dword [ebp - 0xc]
push ebx
call fcn.0044a723
push esi
call fcn.0044c0c2
add esp, 0xc
xor ebx, ebx
jmp 0x461a0f
cmp byte [edi + 0x24], 0
je 0x461996
cmp dword [edi + 0x20], 5
jne 0x461996
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4619a1
mov ebx, dword [edi + 0x18]
jmp 0x4619a3
xor ebx, ebx
push esi
call fcn.0044c0c2
pop ecx
jmp 0x461a0f
test ecx, ecx
jg 0x461978
jl 0x4619b6
test eax, eax
jae 0x461978
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045986f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4619d6
cmp byte [edi + 0x1c], 0
je 0x461978
jmp 0x461a07
push ebx
call fcn.00452a6a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x461978
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x461a0f
cmp byte [edi + 0x1c], 0
je 0x461a0c
mov ebx, dword [edi + 0x18]
jmp 0x461a0f
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045986f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x673db5ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x673db6b1
jmp 0x673db7a4
jmp 0x673db897
jmp 0x673db98a
jmp 0x673dba7d
jmp 0x673dbb70
jmp 0x673dbc63
jmp 0x673dbd56
jmp 0x673dbe49
jmp 0x673dbf3c
jmp 0x673dc02f
jmp 0x673dc122
jmp 0x673dc215
jmp 0x673dc308
jmp 0x673dc3fb
jmp 0x673dc4ee
jmp 0x673dc5e1
jmp 0x673dc6d4
jmp 0x673dc7c7
jmp 0x673dc8ba
jmp 0x673dc9ad
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x673dcaa6
jmp 0x673dcb99
jmp 0x673dcc8c
jmp 0x673dcd7f
jmp 0x673dce72
jmp 0x673dcf65
jmp 0x673dd058
jmp 0x673dd14b
jmp 0x673dd23e
jmp 0x673dd331
jmp 0x673dd424
jmp 0x673dd517
jmp 0x673dd60a
jmp 0x673dd6fd
jmp 0x673dd7f0
jmp 0x673dd8e3
jmp 0x673dd9d6
jmp 0x673ddac9
jmp 0x673ddbbc
jmp 0x673ddcaf
jmp 0x673ddda2
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x673ddeaf
jmp 0x673ddfa2
jmp 0x673de095
jmp 0x673de188
jmp 0x673de27b
jmp 0x673de36e
jmp 0x673de461
jmp 0x673de554
jmp 0x673de647
jmp 0x673de73a
jmp 0x673de82d
jmp 0x673de920
jmp 0x673dea13
jmp 0x673deb06
jmp 0x673debf9
jmp 0x673decec
jmp 0x673deddf
jmp 0x673deed2
jmp 0x673defc5
jmp 0x673df0b8
jmp 0x673df1ab
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x673df2a7
jmp 0x673df39a
jmp 0x673df48d
jmp 0x673df580
jmp 0x673df673
jmp 0x673df766
jmp 0x673df859
jmp 0x673df94c
jmp 0x673dfa3f
jmp 0x673dfb32
jmp 0x673dfc25
jmp 0x673dfd18
jmp 0x673dfe0b
jmp 0x673dfefe
jmp 0x673dfff1
jmp 0x673e00e4
jmp 0x673e01d7
jmp 0x673e02ca
jmp 0x673e03bd
jmp 0x673e04b0
jmp 0x673e05a3
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x673e06af
jmp 0x673e07a2
jmp 0x673e0895
jmp 0x673e0988
jmp 0x673e0a7b
jmp 0x673e0b6e
jmp 0x673e0c61
jmp 0x673e0d54
jmp 0x673e0e47
jmp 0x673e0f3a
jmp 0x673e102d
jmp 0x673e1120
jmp 0x673e1213
jmp 0x673e1306
jmp 0x673e13f9
jmp 0x673e14ec
jmp 0x673e15df
jmp 0x673e16d2
jmp 0x673e17c5
jmp 0x673e18b8
jmp 0x673e19ab
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x673e1ab8
jmp 0x673e1bab
jmp 0x673e1c9e
jmp 0x673e1d91
jmp 0x673e1e84
jmp 0x673e1f77
jmp 0x673e206a
jmp 0x673e215d
jmp 0x673e2250
jmp 0x673e2343
jmp 0x673e2436
jmp 0x673e2529
jmp 0x673e261c
jmp 0x673e270f
jmp 0x673e2802
jmp 0x673e28f5
jmp 0x673e29e8
jmp 0x673e2adb
jmp 0x673e2bce
jmp 0x673e2cc1
jmp 0x673e2db4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x20]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x30], eax
jmp 0x673e2ec1
jmp 0x673e2fb4
jmp 0x673e30a7
Function at 0x67414fd2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67b10018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x67b10018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x674150e5
jmp 0x674151d8
jmp 0x674152cb
jmp 0x674153be
jmp 0x674154b1
jmp 0x674155a4
jmp 0x67415697
jmp 0x6741578a
jmp 0x6741587d
jmp 0x67415970
jmp 0x67415a63
jmp 0x67415b56
jmp 0x67415c49
jmp 0x67415d3c
jmp 0x67415e2f
jmp 0x67415f22
jmp 0x67416015
jmp 0x67416108
jmp 0x674161fb
jmp 0x674162ee
jmp 0x674163e1
mov dword [ebp - 0x14], 0
jmp 0x674164db
jmp 0x674165ce
jmp 0x674166c1
jmp 0x674167b4
jmp 0x674168a7
jmp 0x6741699a
jmp 0x67416a8d
jmp 0x67416b80
jmp 0x67416c73
jmp 0x67416d66
jmp 0x67416e59
jmp 0x67416f4c
jmp 0x6741703f
jmp 0x67417132
jmp 0x67417225
jmp 0x67417318
jmp 0x6741740b
jmp 0x674174fe
jmp 0x674175f1
jmp 0x674176e4
jmp 0x674177d7
mov dword [ebp - 0x18], 0
jmp 0x674178d1
jmp 0x674179c4
jmp 0x67417ab7
jmp 0x67417baa
jmp 0x67417c9d
jmp 0x67417d90
jmp 0x67417e83
jmp 0x67417f76
jmp 0x67418069
jmp 0x6741815c
jmp 0x6741824f
jmp 0x67418342
jmp 0x67418435
jmp 0x67418528
jmp 0x6741861b
jmp 0x6741870e
jmp 0x67418801
jmp 0x674188f4
jmp 0x674189e7
jmp 0x67418ada
jmp 0x67418bcd
mov dword [ebp - 0x10], 0
jmp 0x67418cc7
jmp 0x67418dba
jmp 0x67418ead
jmp 0x67418fa0
jmp 0x67419093
jmp 0x67419186
jmp 0x67419279
jmp 0x6741936c
jmp 0x6741945f
jmp 0x67419552
jmp 0x67419645
jmp 0x67419738
jmp 0x6741982b
jmp 0x6741991e
jmp 0x67419a11
jmp 0x67419b04
jmp 0x67419bf7
jmp 0x67419cea
jmp 0x67419ddd
jmp 0x67419ed0
jmp 0x67419fc3
mov dword [ebp - 0x10], 0
jmp 0x674203c2
jmp 0x6741a0c2
jmp 0x6741a1b5
jmp 0x6741a2a8
jmp 0x6741a39b
jmp 0x6741a48e
jmp 0x6741a581
jmp 0x6741a674
jmp 0x6741a767
jmp 0x6741a85a
jmp 0x6741a94d
jmp 0x6741aa40
jmp 0x6741ab33
jmp 0x6741ac26
jmp 0x6741ad19
jmp 0x6741ae0c
jmp 0x6741aeff
jmp 0x6741aff2
jmp 0x6741b0e5
jmp 0x6741b1d8
jmp 0x6741b2cb
jmp 0x6741b3be
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x67b10014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6741b4c2
jmp 0x6741b5b5
jmp 0x6741b6a8
jmp 0x6741b79b
jmp 0x6741b88e
jmp 0x6741b981
jmp 0x6741ba74
jmp 0x6741bb67
jmp 0x6741bc5a
jmp 0x6741bd4d
jmp 0x6741be40
jmp 0x6741bf33
jmp 0x6741c026
jmp 0x6741c119
jmp 0x6741c20c
jmp 0x6741c2ff
jmp 0x6741c3f2
jmp 0x6741c4e5
jmp 0x6741c5d8
jmp 0x6741c6cb
jmp 0x6741c7be
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x67b1001c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp fcn.6741c8c2
mov eax, dword [0x67b10018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x67419fcf
nop
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x15840b95
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x66dc5ca7
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x408f2c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x408fdc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x408f6a
push 1
call fcn.00409021
pop ecx
jmp 0x408fda
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x408f9f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x408fda
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x408fda
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x130b
push 0x1e56
push 0x1de3
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x40901d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x30]
push 0x1c6d
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x3e3f
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.00409049
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x414316
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41440d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4143d6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x4f9c
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.00414429
add esp, 0x2c
jmp 0x41440b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x4143fe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4143fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x41440b
push 0
push 0x10b1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x414425
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
push 0x5b1f
push 0
push dword [ebp - 0x5c]
call fcn.00413eb1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x415729
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4157b6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x415778
push 0x30c1
push 0x4b89
push 1
push 0x6387
push 0xb72
push 0x8c4
call fcn.00415896
add esp, 0x18
jmp 0x4157b1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x2472
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
push 0x7b6d
push 0x153e
push 0x411
push 0x56be
push 0
push 0
call fcn.0041ef94
add esp, 0x28
jmp 0x415892
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x415835
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41581a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x415833
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x415833
push 0
push 0x10b1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x415892
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x415866
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x415864
push 0xe5d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x415892
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x415892
push 0
push 0x7b94
push 0
push 0x1fbc
call fcn.0042417a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x418827
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x418933
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41890b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4188fc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41889b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x14
jle 0x4188fa
push 1
lea ecx, [ebp - 0x60]
call fcn.00437959
mov dword [ebp - 0x20], 0xffffffff
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x7625
call fcn.00418bdf
add esp, 0x10
push 1
push 1
lea eax, [ebp - 0x20]
push eax
push 0x6c64
push 0x737
lea eax, [ebp - 0x60]
push eax
push 0x68e0
push 1
call fcn.00416083
add esp, 0x20
lea ecx, [ebp - 0x60]
call fcn.00437a2b
jmp 0x418890
jmp 0x418909
push 0xe5d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41892e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x397c
push dword [ebp - 0x28]
push 1
push 1
push 1
push 1
push 0x4267
call fcn.00411831
add esp, 0x1c
jmp 0x4189c0
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x2c]
push 0x4314
push 1
push dword [ebp - 0x30]
push 0x3a6f
push dword [ebp - 0x34]
push 0x2b8a
push 0x21cb
push dword [ebp - 0x38]
push 0x5270
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
push eax
push 0x478b
push 0x7b58
call fcn.004162a4
add esp, 0x4c
mov esp, ebp
pop ebp
ret
Function at 0x41bb07
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41bb80
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41bb59
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4e07
push 0x17d9
push 0
call fcn.0041db47
add esp, 0x14
jmp 0x41bb7e
push 1
push 1
push 0x3801
push 0x72de
push 0x22aa
push 0x3d93
push 0x6c1d
call fcn.004115a7
add esp, 0x1c
jmp 0x41bbcf
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41bbc1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41bbb2
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x41bbbf
push 0xe5d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41bbcf
push 0
push 0x5cb9
call fcn.00415bb6
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f6a3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43f6df
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
call fcn.0043f765
add esp, 0x10
jmp 0x43f761
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43f72e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.0044f329
add esp, 0x10
jmp 0x43f761
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43f759
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43f757
push 0
push 0x10b1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x43f761
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esp, ebp
pop ebp
ret