joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x100
mov dword [eax], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x12c], eax
call fcn.00408c2c
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x120]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
ja 0x409842
mov dword [ebp - 0x10], 0
jmp 0x409984
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.0040a05c
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi], ecx
mov dword [esi + 4], 0
call sub.VERSION.DLL_GetFileVersionInfoA
sub esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x120]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], ecx
mov dword [edi], edx
mov dword [edi + 4], 0x41a11c
mov dword [ebp - 0x130], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x4098e7
cmp dword [ebp - 0x120], 4
jne 0x4098e7
mov eax, dword [ebp - 0x11c]
movzx eax, word [eax]
shl eax, 0x10
mov ecx, dword [ebp - 0x11c]
movzx ecx, word [ecx + 2]
or eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x4098f1
mov dword [ebp - 0x124], 0x40904e4
lea eax, [0x41a135]
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040dff8
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0x120]
mov ebx, esp
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [ebx], esi
mov dword [ebp - 0x134], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x409970
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040c868
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0040a06c
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b094
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa52], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa51], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa50], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa4f], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa4e], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa4d], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFT]
mov byte [0x41aa4c], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEFT]
mov byte [0x41aa4b], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x40b19f
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x40b1a1
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x40b1b4
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0040ba7e
cmp dword [0x41a2e8], ecx
jne 0x40b2b9
mov ecx, fcn.0040be02
cmp dword [0x41a2ec], ecx
jne 0x40b2b9
mov ecx, fcn.0040bffa
cmp dword [0x41a2f0], ecx
jne 0x40b2b9
mov ecx, fcn.0040c314
cmp dword [0x41a2f4], ecx
jne 0x40b2b9
mov ecx, 0x40a3b4
cmp dword [0x41a2f8], ecx
jne 0x40b2b9
xor eax, eax
mov ecx, 0x40a3c4
cmp dword [0x41a2fc], ecx
jne 0x40b2b9
mov ecx, dword [0x41dd40]
test ecx, ecx
jne 0x40b2b9
call fcn.0040b094
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x40b2b9
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0x41dd40], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0040ba7e
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x40d250
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
cmp dword [0x41af4c], esi
jbe 0x40ce50
mov edx, dword [esp + 0x44]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 2
jb 0x40ce5c
mov eax, dword [esi*4 + 0x41af50]
test ah, 0x40
je 0x40ce64
xor edi, edi
test ah, 2
je 0x40ce70
xor eax, eax
jmp 0x40ce5c
mov dword [esp], 0xfffffffa
call fcn.0040da64
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
jmp 0x40d250
test edx, edx
jne 0x40ce78
xor eax, eax
jmp 0x40ce5c
mov ebx, dword [esp + 0x40]
sub edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call 0x40d250
mov ebp, eax
test ebp, ebp
je 0x40cfd1
mov dword [esp + 0x18], edi
mov eax, 0xffffffff
cmp ebp, 0xffffffff
je 0x40ce5c
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], 0x1a
call fcn.0040c510
test eax, eax
je 0x40ced4
or byte [esi*4 + 0x41af51], 2
mov ebp, eax
sub ebp, ebx
je 0x40cfcd
mov dword [esp + 0x1c], eax
lea edi, [ebp + ebx - 1]
cmp byte [ebp + ebx - 1], 0xd
jne 0x40cf07
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 1
call 0x40d250
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x40ce5c
mov dword [esp + 0x24], edi
lea eax, [ebx + ebp]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ebp
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x14], ebx
jmp 0x40cf2d
add edi, ebp
inc ebx
mov esi, ebx
mov ebp, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0xd
call fcn.0040c510
mov ebx, eax
test ebx, ebx
cmove ebx, ebp
mov ebp, ebx
sub ebp, esi
cmp esi, edi
je 0x40cf68
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0040c5d4
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x40cf28
mov ebx, dword [esp + 0x14]
sub edi, ebx
add ebp, edi
mov edi, dword [esp + 0x18]
add edi, ebp
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jae 0x40cfa9
cmp dword [esp + 0x1c], 0
sete al
mov esi, dword [esp + 0x3c]
test byte [esi*4 + 0x41af51], 0x20
sete cl
test ebp, ebp
jne 0x40cfd1
and cl, al
jne 0x40cfbd
jmp 0x40cfd1
cmp dword [esp + 0x1c], 0
sete al
test ebp, ebp
mov esi, dword [esp + 0x3c]
jne 0x40cfd1
test al, al
je 0x40cfd1
add ebx, ebp
mov edx, dword [esp + 0x44]
cmp edi, edx
jb 0x40ce7c
jmp 0x40cfd1
mov edi, dword [esp + 0x18]
mov eax, edi
jmp 0x40ce5c
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x41af4c], eax
jbe 0x40d29d
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x41ffe4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
cmp eax, 1
jne 0x40d2ab
mov eax, dword [esp + 0x14]
jmp 0x40d2c1
mov dword [esp], 6
call fcn.0040da64
jmp 0x40d2c1
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x40d2c1
mov dword [esp], ecx
call fcn.0040da64
add esp, 0x18
pop esi
ret
jmp 0x40ce18
Function at 0x40d2d8
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x41af4c], eax
jbe 0x40d325
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x41ffe4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
cmp eax, 1
jne 0x40d333
mov eax, dword [esp + 0x14]
jmp 0x40d338
mov dword [esp], 6
call fcn.0040da64
jmp 0x40d338
call fcn.0040dae4
add esp, 0x18
pop esi
ret
Function at 0x40f3f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x48]
test ah, 0xc0
je 0x40cc04
mov ebx, eax
jmp 0x40cc13
mov ecx, dword [0x41b01c]
mov ebx, 0xc000
and ebx, dword [ecx]
or ebx, eax
mov edi, ebx
shr edi, 1
and edi, 0x4000
xor edi, 0x4000
or edi, ebx
mov eax, ebx
and eax, 0x700
cmp eax, 0x1ff
ja 0x40cc41
cmp eax, 0x100
jne 0x40cc87
mov ebp, 4
jmp 0x40cc8c
cmp eax, 0x2ff
ja 0x40cc51
cmp eax, 0x200
jne 0x40cc87
jmp 0x40cc79
cmp eax, 0x4ff
ja 0x40cc66
cmp eax, 0x300
jne 0x40cc87
mov ebp, 2
jmp 0x40cc8c
mov ebp, 1
cmp eax, 0x500
je 0x40cc8c
cmp eax, 0x600
jne 0x40cc80
mov ebp, 5
jmp 0x40cc8c
cmp eax, 0x700
je 0x40cc8c
mov ebp, 3
mov eax, ebx
and eax, 0x100
mov dword [esp + 0x1c], eax
je 0x40ccc4
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
and eax, dword [0x41aa98]
mov edx, 1
mov ecx, 0x80
test al, 0x80
cmove ecx, edx
jmp 0x40ccdb
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, 0x80000000
mov edx, ebx
and edx, 3
je 0x40ccfd
cmp edx, 2
jne 0x40ccf3
mov eax, 0xc0000000
jmp 0x40ccfd
cmp edx, 1
jne 0x40cd23
mov eax, 0x40000000
mov edx, ebx
mov esi, edx
and ebx, 0x70
xor edx, edx
cmp ebx, 0x10
je 0x40cd39
cmp ebx, 0x30
jne 0x40cd17
mov edx, 2
jmp 0x40cd39
cmp ebx, 0x20
jne 0x40cd34
mov edx, 1
jmp 0x40cd39
mov dword [esp], 1
call fcn.0040da64
jmp 0x40ce0f
mov edx, 3
mov ebx, esi
test bl, 4
je 0x40cd4b
cmp eax, 0x80000000
sete dl
movzx edx, dl
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], 0
shr ebx, 7
and ebx, 1
xor ebx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x40cde8
mov dword [esp], esi
call fcn.0040cb60
mov dword [esp], esi
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp + 4], ecx
call fcn.0040d6a4
cmp eax, 0xffffffff
jne 0x40ce0f
mov dword [esp], 4
call fcn.0040da64
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, 0xffffffff
jmp 0x40ce0f
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
cmp eax, 0x6e
jne 0x40ce07
mov ecx, 0x50
mov eax, 2
cmp dword [esp + 0x1c], 0
cmovne eax, ecx
mov dword [esp], eax
call fcn.0040da64
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x40cbf0
Function at 0x40f404
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
cmp dword [0x41af4c], esi
jbe 0x40ce50
mov edx, dword [esp + 0x44]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 2
jb 0x40ce5c
mov eax, dword [esi*4 + 0x41af50]
test ah, 0x40
je 0x40ce64
xor edi, edi
test ah, 2
je 0x40ce70
xor eax, eax
jmp 0x40ce5c
mov dword [esp], 0xfffffffa
call fcn.0040da64
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
jmp 0x40d250
test edx, edx
jne 0x40ce78
xor eax, eax
jmp 0x40ce5c
mov ebx, dword [esp + 0x40]
sub edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call 0x40d250
mov ebp, eax
test ebp, ebp
je 0x40cfd1
mov dword [esp + 0x18], edi
mov eax, 0xffffffff
cmp ebp, 0xffffffff
je 0x40ce5c
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], 0x1a
call fcn.0040c510
test eax, eax
je 0x40ced4
or byte [esi*4 + 0x41af51], 2
mov ebp, eax
sub ebp, ebx
je 0x40cfcd
mov dword [esp + 0x1c], eax
lea edi, [ebp + ebx - 1]
cmp byte [ebp + ebx - 1], 0xd
jne 0x40cf07
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 1
call 0x40d250
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x40ce5c
mov dword [esp + 0x24], edi
lea eax, [ebx + ebp]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ebp
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x14], ebx
jmp 0x40cf2d
add edi, ebp
inc ebx
mov esi, ebx
mov ebp, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0xd
call fcn.0040c510
mov ebx, eax
test ebx, ebx
cmove ebx, ebp
mov ebp, ebx
sub ebp, esi
cmp esi, edi
je 0x40cf68
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0040c5d4
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x40cf28
mov ebx, dword [esp + 0x14]
sub edi, ebx
add ebp, edi
mov edi, dword [esp + 0x18]
add edi, ebp
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jae 0x40cfa9
cmp dword [esp + 0x1c], 0
sete al
mov esi, dword [esp + 0x3c]
test byte [esi*4 + 0x41af51], 0x20
sete cl
test ebp, ebp
jne 0x40cfd1
and cl, al
jne 0x40cfbd
jmp 0x40cfd1
cmp dword [esp + 0x1c], 0
sete al
test ebp, ebp
mov esi, dword [esp + 0x3c]
jne 0x40cfd1
test al, al
je 0x40cfd1
add ebx, ebp
mov edx, dword [esp + 0x44]
cmp edi, edx
jb 0x40ce7c
jmp 0x40cfd1
mov edi, dword [esp + 0x18]
mov eax, edi
jmp 0x40ce5c
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x41af4c], eax
jbe 0x40d29d
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x41ffe4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
cmp eax, 1
jne 0x40d2ab
mov eax, dword [esp + 0x14]
jmp 0x40d2c1
mov dword [esp], 6
call fcn.0040da64
jmp 0x40d2c1
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x40d2c1
mov dword [esp], ecx
call fcn.0040da64
add esp, 0x18
pop esi
ret
jmp 0x40ce18
Function at 0x412d18
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
test esi, esi
je 0x412e3b
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetLocalTime
sub esp, 4
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x24], eax
movzx ecx, word [esp + 0x32]
movzx edx, word [esp + 0x2c]
movzx ebx, word [esp + 0x34]
movzx ebp, word [esp + 0x36]
movzx edi, word [esp + 0x38]
movzx eax, word [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02d__02d__04d__02d:_02d:_02d._03d
mov dword [esp], 0x4202c0
call sub.USER32.DLL_wsprintfA
mov dword [esp], 0x4202c0
call fcn.0040c8b4
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0x4202c0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov edi, dword [esp + 0x54]
mov dword [esp], edi
call fcn.0040c8b4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412e4c
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0x4202e0]
mov eax, dword [0x4202e4]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x412f41
test ecx, ecx
jne 0x412f41
cmp dword [0x41c120], 0
je 0x412f83
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.00412be0
test eax, eax
jne 0x412ece
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.00412be0
test eax, eax
je 0x412ed1
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x412f21
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x41304c
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x412f21
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x41300d
test ecx, ecx
je 0x412f58
cmp ecx, 0xffffffff
je 0x41300d
mov dword [esp], edi
call ecx
mov eax, dword [0x4202e4]
test eax, eax
je 0x41300d
cmp eax, 0xffffffff
je 0x41300d
cmp byte [eax], 0
je 0x41300d
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00412d18
jmp 0x41300d
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x41bf70
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.0040c8b4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x41bf70
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret
Function at 0x413e98
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x424314]
test eax, eax
je 0x413edf
mov ecx, dword [eax]
xor edi, edi
test ecx, ecx
je 0x413f6a
add eax, 4
xor edi, edi
nop word cs:[eax + eax]
cmp byte [ecx], 1
sbb ecx, ecx
lea edi, [edi + ecx + 1]
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x413ec8
jmp 0x413f6a
mov esi, dword [0x424350]
test esi, esi
jne 0x413f0c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x424350], esi
test esi, esi
jne 0x413f0c
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.0041302c
mov esi, dword [0x424350]
mov dword [esp], esi
call fcn.0040c8b4
xor ebx, ebx
mov ebp, 1
xor edi, edi
test eax, eax
je 0x413f40
mov ebp, esi
nop dword [eax + eax]
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
lea ebx, [eax + ebx + 1]
inc edi
call fcn.0040c8b4
test eax, eax
jne 0x413f28
inc ebx
mov ebp, ebx
mov dword [esp], ebp
call fcn.0040a05c
mov ecx, eax
mov dword [0x424310], ecx
xor eax, eax
test ecx, ecx
je 0x414015
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.0040c5d4
lea eax, [edi + 4]
mov dword [0x424318], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.0040a044
mov esi, eax
xor eax, eax
test esi, esi
je 0x414015
mov edi, dword [0x424314]
test edi, edi
je 0x413fc7
mov edx, dword [edi]
test edx, edx
je 0x414002
lea eax, [edi + 4]
xor ecx, ecx
nop
cmp byte [edx], 0
jne 0x413fb8
dec ecx
jmp 0x413fbb
mov dword [esi + ecx*4], edx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x413fa8
jmp 0x413ffe
mov ebx, dword [0x424310]
mov dword [esp], ebx
call fcn.0040c8b4
test eax, eax
je 0x41400a
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [eax + ebx + 1]
mov dword [esp], ebx
add ebp, 4
call fcn.0040c8b4
test eax, eax
jne 0x413fe8
test edi, edi
je 0x41400a
mov dword [esp], edi
call fcn.0040a06c
mov dword [0x424314], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x3c244434
xor al, 0xc7
and al, 0x3c
xor al, 0x6c
mov cl, 0x35
xor al, 0xc7
and al, 0x3c
xor al, 0xe5
and al, 0x3c
xor al, 0xac
mov cl, 0x35
xor al, 0xf4
and al, 0x3c
xor al, 0x22
and al, 0x3c
xor al, 0xbc
mov cl, 0x35
xor al, 0x22
and al, 0x3c
xor al, 0x3e
and eax, 0xb1e4343c
xor eax, 0x3c253e34
xor al, 0x5a
and eax, 0xb1f0343c
xor eax, 0x3c255a34
xor al, 0x79
and eax, 0xb1fc343c
xor eax, 0x3c258434
xor al, 0x6d
sub bh, byte [esp + esi]
or byte [ecx + 0x2a6d3435], dh
cmp al, 0x34
xchg esp, eax
sub bh, byte [esp + esi]
push esp
mov bl, 0x35
xor al, 0x94
sub bh, byte [esp + esi]
mov ebx, 0x70343c2a
mov bl, 0x35
xor al, 0xbb
sub bh, byte [esp + esi]
sbb byte [edx], ch
cmp al, 0x34
invalid

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x40d757
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
cmp eax, 0x7f
mov ebp, esp
push edi
push esi
push ebx
push ebx
mov dword [ebp - 0x10], edx
jg 0x40d774
lea ecx, [eax - 0x41]
lea edx, [eax + 0x20]
cmp ecx, 0x19
jmp 0x40d7f8
cmp eax, 0xffff
jg 0x40d7ec
or ebx, 0xffffffff
xor esi, esi
mov edi, 0xa2
lea ecx, [esi + edi]
sar ecx, 1
movzx edx, word [ecx*4 + 0x4a0380]
cmp eax, edx
js 0x40d79d
lea esi, [ecx + 1]
mov ebx, ecx
jmp 0x40d7a0
lea edi, [ecx - 1]
cmp esi, edi
jle 0x40d785
movzx esi, word [ebx*4 + 0x4a0380]
movzx ecx, byte [ebx*4 + 0x4a0383]
add ecx, esi
cmp eax, ecx
jge 0x40d7dc
mov cl, byte [ebx*4 + 0x4a0382]
xor esi, eax
mov ebx, ecx
and ebx, 1
test ebx, esi
jne 0x40d7dc
shr cl, 1
movzx ecx, cl
add ax, word [ecx + ecx + 0x49ff00]
movzx eax, ax
cmp dword [ebp - 0x10], 0
je 0x40d7fb
pop ecx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004078fa
lea ecx, [eax - 0x10400]
lea edx, [eax + 0x28]
cmp ecx, 0x27
cmovbe eax, edx
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret