joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5d7f56d9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x31143719
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x34b41766
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x7e646e5b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x49625d
Capabilities:
Encode data using xor

Disassembly:
call 0x84ce87
sbb ah, 4
cmp byte [edx + 0x79], ah
dec esi
mov eax, 0xaced3bed
in eax, dx
cmp ebp, ebp
lodsb al, byte [esi]
dec ecx
and dword [eax], 0x6a
pop es
xor eax, 0xa53a11d
mov esp, 0xb604317f
movsd dword es:[edi], dword [esi]
inc edx
xchg esp, eax
xor dword [edi + 0x1c], edi
jp 0x49626a
dec edi
mov ch, 0x1b
scasb al, byte es:[edi]
cdq
into
adc byte [edx], ch
pop edi
mov eax, dword [0x11d60e4c]
daa
sbb dl, byte [eax + 0x23]
add byte [edi + 0x12], 0xf7
imul esp, esi, 0xffffff8c
arpl word [edx], di
dec edi
xchg esp, eax
mov ah, 0x63
pop esi
add esp, edi
retf
Function at 0x8ae8e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx + 0x10]
pushfd
mov byte [esp + 0xc], al
mov dword [esp + 0x48], eax
call fcn.00856ab8
cmc
aaa
sbb ecx, 0x2e
inc ecx
jg 0x8ae954
in al, 0xf0
scasb al, byte es:[edi]
das
xor al, 0xc3
mov esp, 0x84ffd2da
xchg ecx, eax
xchg dword [esi + edx*4 + 0x4ba0aea1], ebx
outsb dx, byte [esi]
nop
mov dword [0xcfb0e2d0], eax
cwde
cmpsb byte [esi], byte es:[edi]
jecxz 0x8ae8f7
mul byte [ebx]
aas
xor byte [edx + 0x5753a30a], dl
invalid
mov ecx, 0xb8a47e9a
sub eax, 0xa2140115
add dword [edx], edx
add dword [ecx + eax*8 + 0xd06fe13], 0x73020117
cvtpi2ps xmm1, qword [edx + 0x33]
nop
add byte [ebx], bl
and eax, 0x9db6443c
push esp
xor dl, al
jb 0x8ae95b
invalid

Function at 0x8bafcd
Capabilities:
Encode data using xor

Disassembly:
or dword [edi], ebx
push ebx
fnstenv [0x77c23f5d]
test al, 0xbd
dec edx
cmpsb byte [esi], byte es:[edi]
sub al, 0x88
in al, 0x34
and eax, eax
mov dword [ebx], ecx
xor al, 0x23
sal dl, 0x89
or al, 0xa3
sub byte es:[ebp + 0x11767bb8], bh
or al, 0xaf
cmp al, 0x74
outsd dx, dword [esi]
inc edx
inc esp
in eax, dx
out dx, eax
jo 0x8baf90
mov dl, 0xf5
test byte [esi], 0xbe
jecxz 0x8bafed
fisubr word [ecx + 0x3b7c8143]
aad 0xbf
movsx si, dl
mov esi, eax
mov byte [esp], 0x82
pushal
pushfd
pushfd
mov dword [esp + 0x28], 0x857851
call fcn.00482d56
sbb dword [ebp + 0x5a], edi
adc al, 0x27
jg 0x8baf80
xchg edx, eax
pushfd
jg 0x8bafd3
invalid

Function at 0x9c6c2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg ah
sbb ah, ch
push ebp
and bp, sp
sub eax, 0xcccd658
adc al, bh
mov ebp, esp
bsf ax, dx
or eax, 0xc2e0d521
sub esp, 0x18
movzx eax, bl
add ax, 0x8a47
push esi
push 0x77f44fc9
sal eax, 0x1b
inc al
mov dword [esp], edi
bsf ax, bx
xor eax, 0x528952
push ebx
sar al, 1
bsr ax, di
push edx
shld eax, eax, 0x1d
pushfd
mov eax, dword [ebp + 8]
test dl, 0x3d
test eax, eax
push dword [esp]
lea esp, [esp + 8]
je fcn.009c5d0b
test bp, 0x3a66
mov dl, 0xfb
add si, 0xec96
mov esi, dword [eax + 0x3c]
btc dx, sp
sbb dx, 0x12c6
add esi, eax
setne dh
shr dh, 1
sar edx, cl
mov edx, dword [esi + 0x78]
push 0xb3ad0125
pushal
mov word [esp], 0x1dab
test edx, edx
mov byte [esp], 0xff
pushfd
pushfd
lea esp, [esp + 0x2c]
je fcn.009c5d0b
rcr cx, 9
clc
clc
sbb cx, bx
add edx, eax
movsx cx, bl
bswap ecx
mov ecx, dword [esi + 0x7c]
pushal
pushal
add ecx, edx
mov word [esp + 4], 0x7070
test ebx, ebx
cmc
clc
mov dword [ebp - 0x10], ecx
rcl cl, 3
not ecx
mov ecx, dword [ebp + 0xc]
clc
cmp bp, sp
cmp ecx, 0xffff
jmp 0x9c7e91
Function at 0x4013c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4013f6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x40146e
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call fcn.00401160
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
cmp dword [ebp + 0xc], edx
jb 0x401436
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp edx, dword [ebp - 0xc]
jbe 0x40143d
mov eax, 0xc1
jmp 0x401470
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0044b090
add esp, 0xc
jmp 0x4013e4
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401fb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x401fc8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x40201a
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x401fe9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x40200b
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
xor edx, edx
sub edx, ecx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x401fe0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x469920], ecx
jmp 0x401fbf
mov dword [ebp - 4], 0x100
jmp 0x40202c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x800
jae 0x402064
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x469520]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xff
mov eax, dword [ebp - 0x10]
shr eax, 8
xor eax, dword [edx*4 + 0x469920]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x469920], eax
jmp 0x402023
mov dword [0x469918], 0x4020b0
mov dword [0x469914], 0x4020b0
mov esp, ebp
pop ebp
ret
Function at 0x404830
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x4660c4]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
cmp eax, 6
je 0x40488b
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x40488b
push 0xc00
call dword [ebp - 0x2e8]
test eax, eax
je 0x40488b
jmp 0x4049f3
push 0x106
lea ecx, [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
je 0x4048b8
cmp dword [ebp - 0x2e0], 0x104
jbe 0x4048bd
jmp 0x4049f3
mov edx, dword [ebp - 0x2e0]
movzx eax, word [ebp + edx*2 - 0x2d6]
cmp eax, 0x5c
je 0x4048f2
mov ecx, 0x5c
mov edx, dword [ebp - 0x2e0]
mov word [ebp + edx*2 - 0x2d4], cx
mov eax, dword [ebp - 0x2e0]
add eax, 1
mov dword [ebp - 0x2e0], eax
mov ecx, dword [str.userenv]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [ebp - 0x2e4]
movsx eax, byte [edx]
test eax, eax
je 0x4049f3
mov ecx, dword [ebp - 0x2e0]
lea edx, [ebp + ecx*2 - 0x2d4]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x2e4]
mov cl, byte [eax]
mov byte [ebp - 0x2d5], cl
mov edx, dword [ebp - 0x2e4]
add edx, 1
mov dword [ebp - 0x2e4], edx
movsx eax, byte [ebp - 0x2d5]
test eax, eax
jne 0x40494c
jmp 0x40496e
movzx cx, byte [ebp - 0x2d5]
mov edx, dword [ebp - 0x2dc]
mov word [edx], cx
mov eax, dword [ebp - 0x2dc]
add eax, 2
mov dword [ebp - 0x2dc], eax
jmp 0x404922
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x2e
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 0
mov eax, 0x64
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 1
mov eax, 0x6c
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
imul eax, edx, 3
mov ecx, 0x6c
mov edx, dword [ebp - 0x2dc]
mov word [edx + eax], cx
mov eax, 2
shl eax, 2
xor ecx, ecx
mov edx, dword [ebp - 0x2dc]
mov word [edx + eax], cx
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4048fe
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449e87
mov esp, ebp
pop ebp
ret
Function at 0x40ca80
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x6a09e667
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x20], 0xbb67ae85
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x3c6ef372
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0xa54ff53a
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x510e527f
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x9b05688c
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x1f83d9ab
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x5be0cd19
pop ebp
ret 4

Function at 0x40cfb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.0044ef87
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0040ccb0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458215
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x468ed4]
test eax, eax
jne 0x41187f
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
cmp dword [ebp - 0x1c], 0
je 0x41187d
mov al, 1
jmp 0x4118fd
jmp 0x411893
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x411893
mov al, 1
jmp 0x4118fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4118a4
xor al, al
jmp 0x4118fd
lea ecx, [ebp - 0x60]
call fcn.004112a0
mov dword [ebp - 4], 1
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x60]
call fcn.00412dc0
movzx eax, al
test eax, eax
jne 0x4118e0
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00411350
mov al, byte [ebp - 0xd]
jmp 0x4118fd
lea ecx, [ebp - 0x60]
call fcn.004120b0
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00411350
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x411c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45828d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00413790
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x411cb2
mov ecx, dword [ebp - 0x10]
and ecx, 0x10
jne 0x411cb2
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x411cb2
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412780
movzx edx, al
test edx, edx
jne 0x411cb2
xor al, al
jmp 0x411d1b
movzx eax, byte [0x468ed4]
test eax, eax
jne 0x411d07
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
cmp dword [ebp - 0x1c], 0
je 0x411d05
mov al, 1
jmp 0x411d1b
jmp 0x411d19
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x411d19
mov al, 1
jmp 0x411d1b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x412120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458310
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x4660c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x370], 0x114
movzx eax, byte [0x468ed4]
test eax, eax
jne 0x4121fa
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x35c], edx
cmp dword [ebp - 0x35c], 0x115
jae 0x412180
jmp 0x412185
call fcn.0044a357
mov eax, dword [ebp - 0x35c]
mov byte [ebp + eax - 0x128], 0
lea ecx, [ebp - 0x128]
push ecx
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x358], eax
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x37c]
push eax
call fcn.0040f150
mov dword [ebp - 0x368], eax
mov ecx, dword [ebp - 0x368]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x36c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040dcb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x37c]
call fcn.0040d110
jmp 0x412252
mov eax, 2
imul ecx, eax, 0
mov dword [ebp - 0x360], ecx
cmp dword [ebp - 0x360], 0x22a
jae 0x412216
jmp 0x41221b
call fcn.0044a357
xor edx, edx
mov eax, dword [ebp - 0x360]
mov word [ebp + eax - 0x354], dx
lea ecx, [ebp - 0x354]
push ecx
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x358], eax
lea edx, [ebp - 0x354]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040de30
mov eax, dword [ebp + 8]
push eax
call fcn.00414f00
cmp dword [ebp - 0x358], 0
je 0x41227c
cmp dword [ebp - 0x358], 0x114
jae 0x41227c
mov dword [ebp - 0x364], 1
jmp 0x412286
mov dword [ebp - 0x364], 0
mov al, byte [ebp - 0x364]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00449e87
mov esp, ebp
pop ebp
ret 4

Function at 0x412780
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457f6d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x468ed4]
test eax, eax
jne 0x4127fe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.0040f180
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040d110
cmp dword [ebp - 0x18], 0
je 0x4127fc
mov al, 1
jmp 0x412816
jmp 0x412814
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x412814
mov al, 1
jmp 0x412816
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x413790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45828d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x468ed4]
test eax, eax
jne 0x413805
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
mov eax, dword [ebp - 0x1c]
jmp 0x413820
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x41381d
mov eax, dword [ebp - 0x10]
jmp 0x413820
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x413d60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x413d97
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413d97
xor al, al
jmp 0x413db4
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.00449f00
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x414350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x400000
jbe 0x414369
mov dword [ebp + 0xc], 0x400000
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.004107f0
mov byte [ebp - 1], al
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415bb0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4660c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], SysReAllocStringLen
mov dword [eax + 4], ecx
mov dword [ebp - 0x64], 0x40
push str.GlobalMemoryStatusEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x415c21
lea edx, [ebp - 0x64]
push edx
call dword [ebp - 0x68]
test eax, eax
je 0x415c21
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00415a90
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
jmp 0x415c4b
mov dword [ebp - 0x24], 0x20
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00415a60
xor edx, edx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449e87
mov esp, ebp
pop ebp
ret 4

Function at 0x42c020
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45989d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x98
call fcn.0042c120
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.0040d330
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.0040d390
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.0040d390
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x15], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.0040dcb0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0040df30
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.0040d180
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.00413770
movzx ecx, al
test ecx, ecx
jne 0x42c0dc
mov dword [ebp - 0x18], 1
jmp 0x42c0e3
mov dword [ebp - 0x18], 0
mov dl, byte [ebp - 0x18]
mov byte [ebp - 0xd], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040d110
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x42c107
call fcn.00413d30
jmp 0x42c109
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x432b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458800
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4660c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00430c30
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0042db70
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0040d110
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0040d080
mov ecx, dword [ebp - 0x10]
call fcn.00432aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret