joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
xor esi, esi
lea ecx, [eax + 0x21]
movzx edi, byte [ecx + 1]
xor edx, edx
mov dh, byte [ecx - 1]
mov dl, byte [ecx]
add ecx, 4
shl edx, 8
or edx, edi
movzx edi, byte [ecx - 2]
shl edx, 8
or edx, edi
mov dword [ebp + esi*4 - 0x150], edx
inc esi
cmp esi, 0x10
jl 0x417a1e
push 0x40
lea ecx, [ebp - 0x148]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x417a50
mov esi, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
and dword [ebp - 4], 0
mov dword [ebp - 8], esi
mov esi, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0xc]
mov edi, ecx
not edi
and edi, dword [ebp - 8]
mov ebx, edx
and ebx, ecx
or edi, ebx
rol esi, 5
add esi, edi
mov edi, dword [ebp - 4]
add esi, dword [ebp + edi*4 - 0x150]
mov edi, dword [ebp - 0x10]
inc dword [ebp - 4]
lea esi, [esi + edi + 0x5a827999]
mov edi, dword [ebp - 8]
ror ecx, 2
cmp dword [ebp - 4], 0x14
mov dword [ebp - 8], edx
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
jl 0x417a81
mov dword [ebp - 4], 0x14
mov ebx, dword [ebp - 8]
xor ebx, edx
xor ebx, ecx
rol esi, 5
add esi, ebx
mov ebx, dword [ebp - 4]
add esi, dword [ebp + ebx*4 - 0x150]
inc dword [ebp - 4]
lea esi, [esi + edi + 0x6ed9eba1]
mov edi, dword [ebp - 8]
ror ecx, 2
cmp dword [ebp - 4], 0x28
mov dword [ebp - 8], edx
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
jl 0x417ace
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x28
mov edi, edx
or edi, ecx
and edi, dword [ebp - 8]
mov ebx, edx
and ebx, ecx
or edi, ebx
mov ebx, dword [ebp - 4]
add edi, dword [ebp + ebx*4 - 0x150]
rol esi, 5
add esi, dword [ebp - 0x10]
inc dword [ebp - 4]
lea esi, [edi + esi - 0x70e44324]
mov edi, dword [ebp - 8]
ror ecx, 2
push 0x3c
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edx
pop edi
cmp dword [ebp - 4], edi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
jl 0x417b0f
mov dword [ebp - 4], edi
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
xor edi, edx
xor edi, ecx
add edi, dword [ebp + ebx*4 - 0x150]
mov ebx, dword [ebp - 8]
rol esi, 5
add esi, dword [ebp - 0x10]
inc dword [ebp - 4]
ror ecx, 2
cmp dword [ebp - 4], 0x50
mov dword [ebp - 8], edx
lea esi, [edi + esi - 0x359d3e2a]
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
jl 0x417b55
mov edi, dword [eax]
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
mov ecx, dword [eax + 8]
add ecx, edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [eax], edi
pop edi
add ecx, ebx
and dword [eax + 0x1c], 0
mov dword [eax + 4], esi
pop esi
mov dword [eax + 0x10], ecx
pop ebx
leave
ret
Function at 0x42a82e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469be9
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x4910a8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x492714], 0
jne 0x42a874
mov dword [0x492714], 1
jmp 0x42a9f4
cmp dword [0x49654c], 0
jne 0x42a9f4
lea eax, [ebx + 0x28]
call fcn.00427706
test eax, eax
jbe 0x42a9f4
mov edi, dword [ebx + 0x78]
mov esi, dword [ebx + 0x74]
xor eax, eax
cmp dword [ebx + 0x84], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edi
jne 0x42a8d7
push 0x10
call fcn.0044f788
test eax, eax
je 0x42a8cf
push edi
push esi
mov esi, eax
call fcn.00415746
jmp 0x42a8d1
xor eax, eax
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x84]
lea esi, [esp + 0x20]
call fcn.00425f87
and dword [esp + 0x60], 0
mov eax, dword [ebx + 0x88]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea esi, [esp + 0x38]
call fcn.0041554d
push edi
push dword [esp + 0x14]
mov eax, esi
push 0
push 0
lea esi, [esp + 0x30]
mov byte [esp + 0x70], 1
call fcn.00425f3d
lea esi, [esp + 0x28]
lea edi, [ebx + 0x28]
call fcn.004255e2
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jmp 0x42a97c
call fcn.00409196
cmp dword [eax], 0
je 0x42a96f
lea esi, [esp + 0x14]
call fcn.00409196
mov eax, dword [eax]
cmp dword [eax + 0x44], 1
je 0x42a96f
call fcn.00409196
mov eax, dword [eax]
cmp dword [eax + 0x44], 2
je 0x42a96f
call fcn.00409196
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
call dword [eax + 0x10]
lea edi, [esp + 0x30]
lea esi, [esp + 0x14]
call fcn.00425751
lea esi, [esp + 0x28]
lea edi, [ebx + 0x28]
call fcn.0040feb4
mov edi, eax
lea esi, [esp + 0x14]
call fcn.0042577b
test al, al
lea esi, [esp + 0x14]
jne 0x42a936
push dword [ebx + 4]
call fcn.00425f65
push dword [esp + 0x1c]
xor edi, edi
push dword [esp + 0x14]
mov byte [esp + 0x68], 2
mov ecx, dword [ebx + 0x84]
push edi
push edi
lea eax, [esp + 0x54]
call fcn.00415609
mov ecx, dword [ebx + 0x84]
cmp ecx, edi
je 0x42a9d9
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0x84], edi
push dword [esp + 0x14]
call fcn.0044f79a
push dword [esp + 0x3c]
call fcn.0044f7e8
push dword [esp + 0x20]
call fcn.0044f79a
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437559
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46bc05
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4910a8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x492514]
xor esi, esi
inc esi
mov dword [esp + 0xc], eax
and dword [esp + 0x30], 0
push 0x496758
lea eax, [esp + 0x10]
push 0x481908
push eax
call fcn.00403f43
mov eax, dword [0x492514]
and dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00407f18
push dword [esp + 0xc]
lea edi, [esp + 0x1c]
call fcn.00407e86
test eax, eax
je 0x437612
and dword [esp + 0x14], 0
lea edi, [esp + 0x10]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.00407e13
push esi
push 0x480f38
mov ecx, edi
call fcn.00429519
mov esi, eax
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x437612
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x437626
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x30], 0
je 0x437635
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x18]
call fcn.00404281
lea ecx, [esp + 0xc]
call fcn.00404281
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44f10a
Capabilities:
Encode data using xor

Disassembly:
pop ds
sub byte [eax + 0xa7efb8], dl
rcl byte [edx], 0xd5
mov al, byte cs:[0xa63731ee]
stc
push eax
pop ebp
lea ebp, [ebx - 0x42]
cdq
jge 0x44f181
invalid
push cs
rcr dword [ebp - 0xd], 1
adc bh, byte [eax - 0x4b]
sbb eax, 0x8605a1b3
push ecx
bound eax, qword [eax]
xor eax, dword [ebx]
xchg esp, eax
movsd dword es:[edi], dword [esi]
adc dword [eax + 0xb7dbf88], edi
lcall 0x2f4d, 0x3d70c5e9
jo 0x44f181
dec ebp
das
xchg edi, eax
stc
jecxz 0x44f125
dec ebp
jmp 0xbca64a61
inc ebx
nop
scasd eax, dword es:[edi]
or al, 0xde
shr byte [ecx - 0xb73766b], 1
cmpsb byte [esi], byte es:[edi]
or ch, bl
pop esp
push ebx
push ebx
add al, 0x53
aas
aad 0x25
invalid
push edi
out dx, al
leave
dec edi
xchg edi, eax
xchg ebp, eax
lcall 0xaeaf, 0x28157718
jecxz 0x44f142
or al, 0x45
mov ebp, 0x489b6a4b
in eax, dx
mov ebx, 0xf72bad3e
add ecx, ecx
or cl, dl
dec esp
sbb al, dh
and eax, 0xb07ee47
lea ebp, [edi + 0x63d9861c]
bound edi, qword [ebx - 0x5f]
cld
test byte [eax - 0x66eb9674], al
daa
outsb dx, byte [esi]
stosb byte es:[edi], al
xor eax, 0xf682986e
jo 0x44f159
invalid

Function at 0x451f3e
Capabilities:
Encode data using xor

Disassembly:
sub esp, edi
mov byte [edx], ch
xor al, byte [edi + 0x21]
insd dword es:[edi], dx
and dh, byte [ebp + 0x28]
lodsb al, byte [esi]
out 0x40, al
test al, 0x23
cmp al, 0xde
pop eax
jl 0x451f7f
sal byte [ebx - 0x58c021c8], 0x8c
iretd
in al, dx

Function at 0x452c4e
Capabilities:
Encode data using xor

Disassembly:
invalid
inc ebx
mov dh, 0xa
sub bl, byte [esi]
xchg ecx, eax
shr byte [ebp + 0x7d191139], cl
aaa
lcall 0x27c7, 0xef827c86
jne 0x452bfb
adc byte [edx + 0x30], dh
cmp eax, 0x9a8e7e63
arpl word [esi - 0x72], di
invalid
jle 0x452bf8
outsd dx, dword [esi]
mov edi, 0x8ef6401e
scasd eax, dword es:[edi]
sub al, 0xed
Function at 0x10003b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x210
call fcn.10003b14

Function at 0x100085a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x100085f0
cmp edi, esi
jb 0x1000865b
cmp edi, dword [ebp + 0x10]
ja 0x1000866e
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x100085f2
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x100085e0
jmp 0x1000864f
ja 0x100085f9
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x100085b5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x10008630
mov ebx, esi
sub ecx, edx
jns 0x10008647
jmp 0x10008651
cmp esi, edi
je 0x10008682
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x10008651
xor al, 1
cmp ebx, edi
jne 0x10008610
jmp 0x10008651
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x42124b0
call fcn.100071b0
add esp, 4
ud2
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x42124b0
call fcn.100068e0
add esp, 4
ud2
mov ecx, 0x421ab8c
mov edx, 0x2b
push 0x42124a0
call fcn.10006dd0
add esp, 4
ud2
Function at 0x10028dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
cmp byte [edx + 0x1195], 0
mov edi, edx
mov dword [esp + 4], ecx
je 0x10028e26
mov edx, edi
lea ecx, [esp + 8]
push ebx
push esi
push eax
push 3
push 0
call fcn.100275e0
add esp, 0x14
movq xmm0, qword [esp + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
movd ecx, xmm0
test ecx, ecx
je 0x10028eed
mov ecx, dword [esp + 4]
movq qword [ecx], xmm0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
jmp 0x10028f24
cmp byte [edi + 0x1196], 0
je 0x10028f2c
mov byte [edi + 0x1190], 0xc
xor edi, edi
lea esi, [0x4213e99]
lea edx, [0x4213e9a]
mov eax, 0xfffffff9
mov dword [esp + 0x18], 0
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10028e85
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x10028f87
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10028ea6
shld dword [esp + 0x18], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10028e60
mov ecx, 0x4213b3b
mov edx, 9
xor ebx, 0x12
call fcn.1000af30
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x4213940
mov edx, 0x12
cmove edi, esi
call fcn.1000af30
mov ecx, dword [esp + 4]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
jmp 0x10028f24
movzx ecx, byte [edi + 0x118b]
cmp ecx, 0x10
jae 0x10028f73
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], eax
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
mov eax, dword [esp + 4]
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1190], 0xd
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
lea ecx, [esp + 8]
push ebx
push esi
push eax
push 2
push 0
call fcn.100275e0
add esp, 0x14
movq xmm0, qword [esp + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
movd ecx, xmm0
test ecx, ecx
jne 0x10028e13
movzx ecx, byte [edi + 0x118b]
cmp ecx, 0x10
jb 0x10028ef9
mov edx, 0x10
push 0x4213ea4
jmp 0x10028f7d
mov edx, 0x10
push 0x4213eb4
call fcn.10006410
add esp, 4
ud2
mov ecx, 0x421a5f4
mov edx, 0xe
push 0x4212e44
call fcn.10006dd0
add esp, 4
ud2
Function at 0x10029b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x118a], 3
mov edi, edx
mov esi, ecx
jne 0x10029bda
movzx ecx, byte [edi + 0x118c]
cmp ecx, 0x10
jae 0x10029cd2
movzx eax, byte [edi + 0xa8]
mov dword [esi], 0
and al, 1
mov byte [edi + ecx*8], al
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1190], 0xd
jmp 0x10029cca
lea ecx, [esp + 8]
mov edx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.100275e0
add esp, 0x14
movq xmm0, qword [esp + 8]
movd eax, xmm0
test eax, eax
je 0x10029c1a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x10029cca
mov dword [esp], esi
mov byte [edi + 0x1190], 0xc
xor edi, edi
lea esi, [0x4213e5d]
lea edx, [0x4213e5e]
mov eax, 0xfffffff9
mov dword [esp + 4], 0
nop
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10029c65
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x10029ce6
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10029c86
shld dword [esp + 4], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10029c40
mov ecx, 0x4213b3b
mov edx, 9
xor ebx, 0x1a
call fcn.1000af30
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x4213940
mov edx, 0x12
cmove edi, esi
call fcn.1000af30
mov ecx, dword [esp]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, 0x10
push 0x4213e88
call fcn.10006410
add esp, 4
ud2
mov ecx, 0x421a5f4
mov edx, 0xe
push 0x4212e44
call fcn.10006dd0
add esp, 4
ud2
Function at 0x100347d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
cmp dword [edx + 8], 0
call fcn.100347e8

Function at 0x10037c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 0x10]
or eax, dword [ebp + 8]
or esi, edx
mov edx, dword [ebp + 0xc]
and ecx, 0xfffff000
or esi, ecx
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10031e00
add esp, 8
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10037ca2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
jmp 0x10037d79
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], edi
xor edi, edi
lea esi, [0x42174b9]
mov ecx, 0xfffffff9
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [0x42174ba]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, eax
mov eax, ebx
add al, 0xd0
cmp al, 0xa
jb 0x10037cf1
or bl, 0x20
mov eax, ebx
add al, 0x9f
cmp al, 6
jae 0x10037d81
add bl, 0xa9
mov eax, ebx
mov edx, edi
movzx ebx, al
lea eax, [esi + 1]
shl edx, 4
or ebx, edx
test ecx, ecx
cmove eax, esi
je 0x10037d11
shld dword [ebp - 0x18], edi, 4
inc ecx
test esi, esi
mov edi, ebx
jne 0x10037cd0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10037d32
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
and eax, 0xfff
movzx eax, byte [ecx + eax]
mov byte [edx + 4], al
mov dword [edx], 0
jmp 0x10037d79
mov ecx, 0x421a9d1
mov edx, 0x13
xor ebx, 0x2c7
call fcn.1000af30
mov ecx, 0x421a9ad
mov edx, 6
mov edi, eax
call fcn.1000af30
mov edx, dword [ebp - 0x10]
test eax, eax
mov ecx, 1
cmove eax, ecx
test edi, edi
cmove edi, ecx
mov dword [edx], edi
mov dword [edx + 4], eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], 0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x421a5f4
mov edx, 0xe
push 0x4212e44
call fcn.10006dd0
add esp, 4
ud2
Function at 0x40103a
Capabilities:
Check os version
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x437b70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x9c
push esi
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00421990
add esp, 0xc
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x40109b
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x104], 0x94
call esi
test eax, eax
je 0x4011db
mov eax, dword [ebp - 0xf4]
push edi
xor edi, edi
dec eax
je 0x401123
dec eax
jne 0x4011d1
cmp dword [ebp - 0x100], 5
jb 0x4010c5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
jmp 0x4011c7
xor eax, eax
mov word [ebp - 0x114], ax
lea edi, [ebp - 0x110]
push str.ntdll.dll
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x4011d1
lea ecx, [ebp - 0x114]
push ecx
push 0x401023
push 1
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
test eax, eax
je 0x4011d1
mov eax, dword [ebp - 0x110]
dec eax
cmp eax, 1
ja 0x4011d1
movzx edi, word [ebp - 0x114]
jmp 0x4011c7
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
push str.DefaultControl_PanelDesktopResourceLocale
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4011d1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push dword [ebp - 0x108]
mov dword [ebp - 0x10c], ebx
call esi
test eax, eax
jne 0x4011bb
cmp dword [ebp - 0x10c], 1
jne 0x4011bb
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
mov dword [ebp - 0x110], 0x64
call fcn.00421990
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push dword [ebp - 0x108]
call esi
test eax, eax
jne 0x4011bb
lea eax, [ebp - 0x68]
push eax
call fcn.00421983
pop ecx
movzx edi, ax
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp di, bx
je 0x4011d1
movzx eax, di
jmp 0x4011da
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00421a0a
leave
ret
Function at 0x404425
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x437b70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00421990
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x404484
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call esi
test eax, eax
je 0x404576
call fcn.004043e8
cmp dword [ebp - 0x90], 2
jne 0x40453e
cmp dword [ebp - 0x9c], 6
jne 0x4044e8
cmp dword [ebp - 0x98], 0
jne 0x4044c7
cmp byte [ebp - 6], 1
jne 0x4044c0
mov ecx, 0x100
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
jmp 0x404578
mov ecx, 0x400
jmp 0x4044b3
cmp dword [ebp - 0x98], 1
jne 0x404576
cmp byte [ebp - 6], 1
jne 0x4044e1
mov ecx, 0x1000
jmp 0x4044b3
mov ecx, 0x4000
jmp 0x4044b3
cmp dword [ebp - 0x9c], 5
jne 0x404576
cmp dword [ebp - 0x98], 2
jne 0x40451c
cmp byte [ebp - 6], 1
jne 0x40450d
test eax, eax
je 0x404518
push 0x20
pop eax
jmp 0x404578
test eax, eax
je 0x404518
mov eax, 0x80
jmp 0x404578
push 0x40
jmp 0x40450a
cmp dword [ebp - 0x98], 1
jne 0x404531
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
jmp 0x404578
cmp dword [ebp - 0x98], 0
jne 0x404576
push 8
jmp 0x40450a
cmp dword [ebp - 0x90], 1
jne 0x404576
push 4
pop eax
cmp dword [ebp - 0x9c], eax
jne 0x404576
cmp dword [ebp - 0x98], 0
jne 0x404560
xor eax, eax
inc eax
jmp 0x404578
cmp dword [ebp - 0x98], 0xa
jne 0x40456d
push 2
jmp 0x40450a
cmp dword [ebp - 0x98], 0x5a
je 0x404578
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00421a0a
leave
ret
Function at 0x4104e8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x438c0c], 0
jne 0x410524
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4e7
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040f7b5
pop ecx
test esi, esi
pop esi
je 0x410534
mov al, 1
jmp 0x410536
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x41051e
xor al, al
leave
ret 8

Function at 0x41053a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x438c0c], 0
jne 0x410572
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4e7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040f7b5
pop ecx
test esi, esi
pop esi
je 0x41057f
mov al, 1
jmp 0x410581
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x41056c
xor al, al
leave
ret 4

Function at 0x410585
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x438c0c], 0
jne 0x4105c0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4e7
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040f7b5
pop ecx
test esi, esi
pop esi
je 0x4105cf
mov al, 1
jmp 0x4105d1
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x4105ba
xor al, al
leave
ret 4

Function at 0x4105df
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00411234
cmp eax, 0xffffffff
je 0x41060a
test al, 0x10
jne 0x41060a
test al, 1
je 0x41060a
and eax, 0xfffffffe
push eax
push esi
call fcn.004104e8
test al, al
je 0x410642
cmp byte [0x438c0c], 0
push esi
jne 0x410638
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4e7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040f7b5
pop ecx
test esi, esi
je 0x410642
mov al, 1
jmp 0x410644
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x410632
xor al, al
pop esi
leave
ret 4

Function at 0x410652
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x438c0c], 0
jne 0x410689
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4e7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040f7b5
test esi, esi
pop ecx
setne al
pop esi
jmp 0x410698
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
leave
ret 4