joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c0028
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x4c]
mov ebp, dword [esi + 0x40]
mov edi, dword [esi + 0x34]
mov dword [esp + 0x18], eax
movzx eax, ax
movzx ecx, di
movzx ebx, bp
mov dword [esp + 0x1c], eax
add eax, ebx
lea eax, [eax + ecx + 0x2e]
push 0
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.00420890
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0x28]
mov word [ecx + 4], ax
movzx edx, word [esi + 0xa]
mov eax, dword [esp + 0x28]
mov word [eax + 6], dx
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 0x28]
mov word [edx + 8], cx
movzx eax, word [esi + 0xe]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0xa], ax
movzx edx, word [esi + 0x10]
mov eax, dword [esp + 0x28]
mov word [eax + 0xc], dx
movzx ecx, word [esi + 0x12]
mov edx, dword [esp + 0x28]
mov word [edx + 0xe], cx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x28]
mov dword [eax + 0x14], edx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x18], ecx
mov eax, dword [esp + 0x28]
mov word [eax + 0x1c], bp
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov word [ecx + 0x1e], di
mov edx, dword [esp + 0x28]
mov word [edx + 0x20], bp
movzx eax, word [esi + 0x20]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0x22], ax
movzx edx, word [esi + 0x22]
mov eax, dword [esp + 0x28]
mov word [eax + 0x24], dx
mov ecx, dword [esi + 0x24]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x26], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x2a], eax
mov eax, dword [esi + 0x3c]
mov edx, dword [esp + 0x28]
push ebx
push eax
add edx, 0x2e
push edx
mov dword [esp + 0x44], 0
call fcn.0044ac90
add esp, 0xc
test di, di
je 0x412260
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x30]
mov edx, dword [esp + 0x28]
push ecx
push eax
lea eax, [ebx + edx + 0x2e]
push eax
call fcn.0044ac90
add esp, 0xc
test bp, bp
je 0x412285
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov esi, dword [esi + 0x48]
mov eax, dword [esp + 0x28]
push ecx
add ebx, edx
lea ecx, [ebx + eax + 0x2e]
push esi
push ecx
call fcn.0044ac90
add esp, 0xc
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
push 1
push esi
push edx
call fcn.00421650
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.004208c0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x412370
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c0058
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x34]
mov ebp, dword [esi + 0x40]
mov dword [esp + 0x14], eax
movzx eax, ax
movzx edi, bp
lea ebx, [edi + eax + 0x1e]
push 0
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
call fcn.00420890
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4f380c]
mov dword [eax], ecx
movzx edx, word [esi + 0xa]
mov eax, dword [esp + 0x20]
mov word [eax + 4], dx
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 0x20]
mov word [edx + 6], cx
mov ax, word [esi + 0xe]
mov ecx, dword [esp + 0x20]
mov word [ecx + 8], ax
movzx edx, word [esi + 0x10]
mov eax, dword [esp + 0x20]
mov word [eax + 0xa], dx
movzx ecx, word [esi + 0x12]
mov edx, dword [esp + 0x20]
mov word [edx + 0xc], cx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x20]
mov dword [ecx + 0xe], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x20]
mov dword [eax + 0x12], edx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [edx + 0x16], ecx
mov eax, dword [esp + 0x20]
movzx edx, word [esp + 0x14]
mov word [eax + 0x1a], bp
mov ecx, dword [esp + 0x20]
mov word [ecx + 0x1c], dx
mov eax, dword [esi + 0x3c]
push edi
push eax
mov eax, dword [esp + 0x28]
add eax, 0x1e
push eax
mov dword [esp + 0x3c], 0
call fcn.0044ac90
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push eax
lea eax, [edi + edx + 0x1e]
push eax
call fcn.0044ac90
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x50]
add esp, 0x18
push 1
push ebx
push ecx
mov ecx, edi
call fcn.00421650
lea ecx, [esi + 0x2c]
call fcn.00420770
mov eax, dword [edi + 0x78]
mov word [esi + 0x20], ax
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x58]
sub ecx, ebx
add eax, ecx
mov dword [esi + 0x28], eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004208c0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x414fa0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1fc]
push eax
push ecx
mov ecx, esi
call fcn.00413a40
mov dword [esi + 0x1fc], eax
movzx eax, al
add eax, dword [esi + 0x200]
mov ecx, esi
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x200], eax
shr eax, 0x18
mov byte [esp + 8], al
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x204]
push edx
push eax
call fcn.00413a40
mov dword [esi + 0x204], eax
pop esi
ret 4

Function at 0x41d6f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c0db8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esi + 0x1c], edi
call fcn.0041c170
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00401762
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x41d75a
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00443052
add esp, 4
cmp dword [esi + 0x14], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
je 0x41d77e
push 0
mov ecx, edi
call fcn.00415020
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x420d10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c1409
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.CZipStorage.0
call fcn.00422ae0
xor ebx, ebx
lea edi, [esi + 0x3c]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x38], ebx
mov byte [edi + 4], bl
lea ecx, [esi + 0x64]
mov byte [esp + 0x38], 1
call fcn.00420750
push 0x4d059c
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
mov dword [esi + 0x34], ebx
mov dword [esi + 4], 0x10000
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x2c], ebx
call fcn.00418b00
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 3
call fcn.00401762
cmp dword [esp + 0x2c], 0x10
jb 0x420dbc
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00443052
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x420ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c14b1
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4f4524]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov ax, word [esp + 0xf0]
movzx edi, ax
xor ebx, ebx
mov esi, ecx
mov dword [esi + 0x78], edi
cmp ax, bx
je 0x421028
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [esp + 0x30]
push edx
call eax
cmp dword [esi + 0x30], 3
mov dword [esp + 0xe8], ebx
lea ebp, [ebx + 0x10]
jne 0x420f7b
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x420f63
lea eax, [esp + 0x34]
push eax
call fcn.00422490
movzx ecx, al
add esp, 4
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [esi + 0x30], ecx
jmp 0x420f82
mov dword [esi + 0x30], 2
mov ebx, 1
cmp dword [esi + 0x30], ebx
jne 0x420f9b
cmp dword [esi + 0x34], 0
jne 0x420f9e
push 0x67
mov ecx, esi
call fcn.00420de0
mov dword [esi + 0x38], edi
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x420fac
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x50]
call fcn.00417b50
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0xec], bl
call fcn.00420ab0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x3c]
push eax
mov byte [esp + 0xf4], 2
call fcn.00401762
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x2c], ebp
jb 0x420ffa
mov eax, dword [esp + 0x18]
push eax
call fcn.00443052
add esp, 4
lea ecx, [esi + 0x64]
call fcn.00420770
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 0
call fcn.004271f0
cmp dword [esp + 0x48], ebp
jb 0x42102b
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00443052
add esp, 4
jmp 0x42102b
mov dword [esi + 0x30], ebx
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00443ac5
add esp, 0xd8
ret 4
Function at 0x4210c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c14f9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov esi, ecx
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
push edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
call edx
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 1
call edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.00412790
push 0xffffffffffffffff
mov ecx, esi
call fcn.00420e40
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x4219c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c16e9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov esi, ecx
mov dword [esp + 0x18], edi
mov byte [esp + 0x13], 1
mov byte [edi + 4], bl
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], 1
cmp byte [esp + 0x4c], bl
jne 0x421a65
call fcn.00420c10
cmp dword [esi + 0x30], 2
jne 0x421a65
cmp byte [esi + 0x74], bl
je 0x421a65
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004218a0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x4c], 1
call fcn.00401762
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x40], bl
jb 0x421a61
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00443052
add esp, 4
mov byte [esp + 0x13], bl
cmp dword [edi + 0x14], ebx
jne 0x421aa4
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
lea eax, [esp + 0x1c]
push eax
call edx
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x4c], 2
call fcn.00401762
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x40], bl
jb 0x421aa4
mov eax, dword [esp + 0x20]
push eax
call fcn.00443052
add esp, 4
cmp byte [esp + 0x13], bl
je 0x421add
cmp byte [esi + 0x7c], bl
jne 0x421add
cmp byte [esi + 0x7d], bl
jne 0x421ad3
cmp dword [esi + 0x30], ebx
je 0x421ac9
xor eax, eax
cmp byte [esi + 0x74], bl
setne al
lea eax, [eax + eax - 1]
cmp eax, ebx
jl 0x421ad3
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x64]
call fcn.00420770
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret 8

Function at 0x421fe0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x422005
xor al, al
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x422022
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
pop edi
mov al, 1
pop esi
ret

Function at 0x422030
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x422050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x422063
xor al, al
ret
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov al, 1
ret
Function at 0x4222d0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4c17b6
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4f4524]
xor eax, esp
mov dword [esp + 0xc4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0xdc]
mov dword fs:[0], eax
mov eax, dword [esp + 0xec]
push eax
lea ecx, [esp + 0x4c]
call fcn.00417b50
lea eax, [esp + 0x2c]
xor ebx, ebx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xe8], ebx
call fcn.004222b0
mov eax, dword [esp + 0x30]
mov ebp, 0x10
mov byte [esp + 0xe4], 1
cmp dword [esp + 0x44], ebp
jae 0x42234e
lea eax, [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call edi
test eax, eax
jne 0x422415
push 2
push 0xffffffffffffffff
push 0x4d0498
lea ecx, [esp + 0x38]
call fcn.00415320
mov esi, eax
cmp esi, 0xffffffff
jne 0x422397
push eax
push ebx
lea ecx, [esp + 0x34]
call fcn.004012c7
push 0xffffffffffffffff
inc esi
push esi
lea ecx, [esp + 0x34]
call fcn.004012c7
push 0x5c
push 1
lea ecx, [esp + 0x34]
call fcn.00409315
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], ebp
jae 0x4223bf
lea eax, [esp + 0x30]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call edi
test eax, eax
jne 0x422415
cmp dword [esp + 0x44], ebp
jb 0x4223ed
mov eax, dword [esp + 0x30]
push eax
call fcn.00443052
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0xe4], 0xffffffff
call fcn.004271f0
xor eax, eax
jmp 0x422460
mov esi, dword [esp + 0x18]
imul esi, dword [esp + 0x14]
imul esi, dword [esp + 0x1c]
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x44], ebp
jb 0x42243a
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00443052
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0xe4], 0xffffffff
call fcn.004271f0
mov eax, esi
mov ecx, dword [esp + 0xdc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00443ac5
add esp, 0xd4
ret
Function at 0x422490
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4c17fb
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4f4524]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xc8]
push eax
lea ecx, [esp + 0x28]
call fcn.00417b50
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0xc4], 0
call fcn.004222b0
cmp dword [eax + 0x18], 0x10
jb 0x4224fd
mov eax, dword [eax + 4]
jmp 0x422500
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
sete bl
cmp dword [esp + 0x20], 0x10
jb 0x422521
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00443052
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov dword [esp + 0xc0], 0xffffffff
call fcn.004271f0
mov al, bl
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00443ac5
add esp, 0xbc
ret

Function at 0x4226c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c1888
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x42270f
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push esi
call fcn.0042ecfe
add esp, 4
mov edi, eax
push edi
push esi
mov bl, 1
call ebp
test eax, eax
jne 0x422728
xor bl, bl
jmp 0x422760
push edi
lea ecx, [esp + 0x18]
call fcn.00418b00
mov ecx, dword [esp + 0x40]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x44], 0
call fcn.00401762
cmp dword [esp + 0x2c], 0x10
jb 0x422760
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00443052
add esp, 4
push edi
call fcn.0044426a
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x422780
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4227a2
cmp byte [esp + 0xc], al
je 0x42279e
push esi
push 0x71
call fcn.0041a4b0
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x423190
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4231a1
xor al, al
pop esi
ret 4
push str.ZipArchive_Mapping_File
push 0
push 0
push 4
push 0
call fcn.00422cb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi], eax
test eax, eax
je 0x42319b
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
test eax, eax
mov dword [esi + 4], eax
setne cl
mov al, cl
pop esi
ret 4

Function at 0x4251f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x38]
push edi
movzx edi, word [esp + 0xc]
sar eax, 2
cmp edi, eax
jb 0x42520b
call fcn.004485d9
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx + edi*4]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x20], eax
movzx edx, word [eax + 0x20]
push edx
call fcn.00421c50
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x2c]
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x28]
add eax, dword [esi + 0x70]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 0
push 0
push eax
call edx
mov ecx, dword [esi + 0x24]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esi + 0x20]
call fcn.004125c0
test al, al
jne 0x42525a
push 0x65
mov ecx, esi
call fcn.00425150
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.00420770
mov ax, word [esp + 0xc]
test ax, ax
je 0x4252a8
mov edx, dword [esi + 0x24]
push ebx
mov ebx, dword [edx + 0x78]
movzx eax, ax
push 0
push eax
mov ecx, edi
call fcn.004207a0
movzx ecx, word [esp + 0x10]
mov edx, dword [esi + 0x18]
push 1
push ecx
mov ecx, dword [esi + 0x24]
push edx
call fcn.00421d40
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x78], ebx
pop ebx
je 0x4252a8
push 0x65
mov ecx, esi
call fcn.00425150
pop edi
pop esi
ret 4
Function at 0x425fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1be0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4f4524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp byte [esi + 0x84], 0
jne 0x42617f
mov ecx, dword [esi + 0x24]
cmp dword [ecx + 0x30], 0
je 0x426016
xor eax, eax
cmp byte [ecx + 0x74], al
setne al
lea eax, [eax + eax - 1]
test eax, eax
jne 0x426028
call fcn.00420c10
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [esi + 0x3c]
sub ecx, dword [esi + 0x38]
xor bl, bl
sar ecx, 2
mov word [esi + 0x7a], cx
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x7c], 0
cmp dword [ecx + 0x30], 0
mov byte [ebp - 0x11], bl
je 0x4260b9
xor eax, eax
cmp byte [ecx + 0x74], al
setne al
lea eax, [eax + eax - 1]
test eax, eax
je 0x4260b9
cmp dword [ecx + 0x78], 0
jne 0x4260b9
call fcn.00420980
push 1
mov ecx, esi
mov edi, eax
call fcn.00423e30
movzx edx, word [esi + 0x7a]
shl edx, 4
mov ecx, 0xfffffffc
sub ecx, edx
add eax, ecx
cmp edi, eax
jb 0x4260b9
mov ecx, dword [esi + 0x24]
cmp dword [ecx + 0x70], 0
jne 0x4260a2
mov edx, dword [ecx + 0x6c]
sub edx, dword [ecx + 0x58]
cmp edx, eax
jb 0x4260a2
push 1
mov ecx, esi
call fcn.00423e90
jmp 0x4260b4
call fcn.00420c10
push 0
mov ecx, esi
call fcn.00423e90
test al, al
je 0x4260b9
mov bl, 1
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 0
test bl, bl
jne 0x4260e3
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x30], 0
je 0x4260e3
xor edx, edx
cmp byte [eax + 0x74], dl
setne dl
lea edx, [edx + edx - 1]
mov eax, edx
test eax, eax
je 0x4260e3
xor al, al
jmp 0x4260e8
mov eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.004253b0
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx + 0x78]
mov ecx, esi
mov word [esi + 0x74], ax
call fcn.00424430
mov edi, eax
test bl, bl
je 0x42611d
mov edx, dword [esi + 0x24]
cmp dword [edx + 0x78], 0
je 0x42611d
push 0x65
mov ecx, esi
call fcn.00425150
mov eax, dword [esi + 0x24]
movzx ecx, word [esi + 0x74]
mov eax, dword [eax + 0x78]
cmp ecx, eax
je 0x426178
cmp word [esi + 0x7a], 0
mov word [esi + 0x74], ax
je 0x42613e
xor edx, edx
mov word [esi + 0x78], dx
jmp 0x42614c
mov word [esi + 0x76], ax
mov dword [esi + 0x80], 0
mov ecx, dword [esi + 0x24]
cmp dword [ecx + 0x58], edi
jb 0x426159
sub dword [ecx + 0x58], edi
jmp 0x426171
call fcn.00420c10
mov eax, dword [esi + 0x24]
sub dword [eax + 0x70], edi
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, esi
call fcn.00424430
mov byte [esi + 0x84], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4