joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x9d4]
test al, al
push edi
mov edi, dword [esp + 0xc]
je 0x4077ce
cmp dword [esi + 0x9f4], edi
je 0x407883
test al, al
je 0x407806
mov al, byte [esi + 0x9f8]
test al, al
je 0x4077e3
mov byte [esi + 0x9f9], 1
mov eax, dword [esi + 0x9fc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x9fc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x9d4], 0
mov ecx, dword [esi]
mov edx, dword [ecx]
push edi
call dword [edx + 0x1c]
test eax, eax
je 0x407883
mov ecx, dword [esi]
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x210]
test eax, eax
je 0x407883
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0
push 0
lea eax, [esi + 0x9e8]
push eax
push 0x401b10
push 0
push 0
mov dword [eax], esi
mov dword [esi + 0x9ec], ecx
mov dword [esi + 0x9f0], edx
mov dword [esi + 0x9f4], edi
mov byte [esi + 0x9f9], 0
call fcn.00496b63
add esp, 0x18
test eax, eax
mov dword [esi + 0x9fc], eax
je 0x407883
mov ecx, esi
call fcn.00408e20
mov ecx, esi
call fcn.00408df0
mov byte [esi + 0x9d4], 1
pop edi
pop esi
ret 4
Function at 0x40a310
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x40a345
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x40a33e
jne 0x40a345
mov eax, 1
jmp 0x40a347
xor eax, eax
push 0
lea ecx, [esi + 0x860]
push ecx
lea edx, [esi + 0x870]
push edx
mov byte [esi + 0xb44], al
call sub.gdiplus.dll_GdiplusStartup
mov ecx, esi
call fcn.0040a5e0
mov ecx, esi
call fcn.0040b300
mov ecx, esi
call fcn.0040d0c0
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push eax
push ecx
mov ecx, esi
call fcn.004117d0
pop esi
add esp, 0x94
ret 8
Function at 0x40a610
Capabilities:
Set console window title

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
push esi
mov esi, ecx
jg 0x40a624
mov ebp, 0x78
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x2c], eax
jg 0x40a638
mov dword [esp + 0x2c], 0x1e
mov eax, dword [esi + 0xc]
test eax, eax
lea ecx, [eax + 1]
mov dword [esi + 0xc], ecx
jne 0x40a79d
mov al, byte [esi + 0x10]
test al, al
je 0x40a664
mov edx, dword [esp + 0x34]
push edx
mov ecx, esi
call fcn.0040abc0
pop esi
pop ebp
add esp, 0x20
ret 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 1
push 0x40a600
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push 0xf060
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call edi
push 0xfffffffffffffff5
mov dword [esi + 4], eax
call edi
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx edx, word [esp + 0x22]
movsx eax, word [esp + 0x26]
sub eax, edx
inc eax
cmp eax, ebp
mov edx, eax
jl 0x40a6e1
mov edx, ebp
mov eax, dword [esp + 0x24]
movsx edi, word [esp + 0x28]
movsx ecx, ax
sub edi, ecx
lea ecx, [edi + 1]
mov edi, dword [esp + 0x34]
cmp ecx, edi
jl 0x40a6fc
mov ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
dec edx
mov word [esp + 0x14], dx
lea edx, [ecx + eax - 1]
mov ecx, dword [esi + 8]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push eax
push 1
push ecx
mov word [esp + 0x1c], 0
mov word [esp + 0x22], dx
call edi
mov eax, dword [esi + 8]
mov word [esp + 0x3c], bp
mov word [esp + 0x3e], 0x2329
mov edx, dword [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov ecx, dword [esp + 0x34]
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x14], ax
mov word [esp + 0x16], ax
mov eax, dword [esi + 8]
dec ebp
push 1
dec ecx
push eax
mov word [esp + 0x20], bp
mov word [esp + 0x22], cx
call edi
test eax, eax
jne 0x40a78f
push 5
push eax
push eax
push eax
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push edx
call edi
mov eax, dword [esi + 8]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret 0xc
Function at 0x40a930
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x244
push esi
push edi
mov edi, ecx
mov al, byte [edi + 0x10]
test al, al
je 0x40a9ae
mov eax, dword [edi + 0x18]
cmp eax, 0xffffffff
je 0x40a99d
mov ecx, dword [esp + 0x254]
push 0
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x40a99b
lea eax, [esp + 0xc]
push eax
mov byte [esp + esi + 0x10], 0
call fcn.00489a20
add esp, 4
test esi, esi
jle 0x40a98e
mov ecx, dword [esp + 0x250]
sub eax, ecx
mov edi, esi
mov dl, byte [eax + ecx]
mov byte [ecx], dl
inc ecx
dec edi
jne 0x40a985
pop edi
mov eax, esi
pop esi
add esp, 0x244
ret 8
jne 0x40a9a1
mov byte [edi + 0x11], 1
pop edi
xor eax, eax
pop esi
add esp, 0x244
ret 8
push ebx
mov ebx, dword [esp + 0x258]
xor esi, esi
cmp ebx, 0x10
mov eax, 0x10
ja 0x40a9c4
mov eax, ebx
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [edi + 4]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
test eax, eax
je 0x40aa78
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x40aa78
push ebp
mov ebp, dword [esp + 0x258]
mov ecx, 1
lea edx, [esp + 0x122]
mov dword [esp + 0x10], eax
jmp 0x40aa11
mov ebx, dword [esp + 0x25c]
test byte [edx - 0xe], 1
je case.0x40aa48.35
mov eax, dword [edx - 0xa]
test eax, eax
je case.0x40aa48.35
mov al, byte [edx]
test al, al
je 0x40aa2a
cmp esi, ebx
jae case.0x40aa48.35
jmp 0x40aa64
xor eax, eax
mov ax, word [edx - 4]
mov edi, eax
and edi, 0xffff
add edi, 0xffffffdf
cmp edi, 0x55
ja case.0x40aa48.35
xor ebx, ebx
mov bl, byte [edi + 0x40aa94]
jmp dword [ebx*4 + 0x40aa88]
test al, 3
je case.0x40aa48.35
cmp ecx, dword [esp + 0x25c]
jae case.0x40aa48.35
mov byte [esi + ebp], 0x82
inc esi
inc ecx
add al, 0x70
mov byte [esi + ebp], al
inc esi
inc ecx
mov eax, dword [esp + 0x10]
add edx, 0x14
dec eax
mov dword [esp + 0x10], eax
jne 0x40aa0a
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x244
ret 8

Function at 0x40aaf0
Capabilities:
Log keystrokes via polling
Receive data
Receive data on socket

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
mov al, byte [esi + 0x10]
test al, al
push edi
je 0x40ab5b
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x40ab3e
push 0
push 0x100
lea ecx, [esp + 0x10]
push ecx
push eax
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x40ab3c
xor ecx, ecx
test eax, eax
jle 0x40ab3c
mov edx, dword [esp + 0x10c]
movsx edi, byte [esp + ecx + 8]
cmp edi, edx
je 0x40ab4e
inc ecx
cmp ecx, eax
jl 0x40ab2c
test eax, eax
jne 0x40ab97
mov al, 1
pop edi
mov byte [esi + 0x11], al
pop esi
add esp, 0x100
ret 4
pop edi
mov al, 1
pop esi
add esp, 0x100
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40ab97
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, eax
jne 0x40ab97
mov edx, dword [esp + 0x10c]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
pop edi
pop esi
shr eax, 0xf
and eax, 1
add esp, 0x100
ret 4
pop edi
xor al, al
pop esi
add esp, 0x100
ret 4
Function at 0x40b270
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x20
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [esp + 0x10]
xor eax, eax
mov word [esp + 8], ax
mov word [esp + 0xa], ax
movsx eax, word [esp + 0x12]
mov edi, dword [esp + 8]
imul eax, ecx
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 8]
push edi
push eax
push 7
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
movsx ecx, word [esp + 0x12]
movsx edx, word [esp + 0x10]
imul ecx, edx
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 8]
push edi
push ecx
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov edx, dword [esi + 8]
mov word [esp + 0xa], 1
mov ecx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
pop edi
pop esi
add esp, 0x20
ret
Function at 0x410ff0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xb34]
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax + 0x14]
mov ecx, dword [esi + 0x98c]
cmp dword [0x4c8108], ecx
jne 0x41101e
fld qword [0x4c8110]
fcomp st(1)
fnstsw ax
test ah, 0x40
jne 0x411038
fst qword [0x4c8110]
mov dword [0x4c8108], ecx
fild dword [esi + 0x98c]
fdivr st(1)
fstp qword [0x4f44e0]
fstp st(0)
fld qword [esi + 0x990]
fcomp qword [0x4abbd8]
fnstsw ax
test ah, 0x41
jne 0x411166
fld qword [esi + 0x990]
inc edi
fsub qword [0x4f44e0]
fstp qword [esi + 0x990]
fld qword [0x4f44e0]
fadd qword [esi + 0x998]
fstp qword [esi + 0x998]
fld qword [esi + 0x990]
fcomp qword [0x4abbd8]
fnstsw ax
test ah, 0x41
je 0x411051
test edi, edi
je 0x411166
mov eax, dword [esi + 0x9e4]
test eax, eax
je 0x4110ed
mov ecx, dword [esi + 0xa00]
test ecx, ecx
jne 0x4110ae
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0xa00]
cmp eax, 2
mov dword [esi + 0x9e4], 0
jne 0x4110dc
mov ecx, esi
call fcn.00410e10
push 0xffffffffffffffff
mov ecx, esi
call fcn.00410bb0
test al, al
jne 0x4110ed
pop edi
xor eax, eax
pop esi
ret
cmp eax, 3
jne 0x4110ed
mov ecx, esi
call fcn.00410e10
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 0x738]
mov edx, dword [esi + 0x734]
mov eax, dword [esi + 0x730]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi + 0x818]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x9fc]
push 0
push 0
lea edx, [esi + 0x9e8]
push edx
push 0x410f40
add eax, edi
push 0
push 0
mov dword [esi + 0x9fc], eax
mov dword [esi + 0xa00], 0
call fcn.00496b63
add esp, 0x18
test eax, eax
mov dword [esi + 0x9e4], eax
jne 0x411166
mov ecx, esi
call fcn.00410e10
pop edi
xor eax, eax
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x411680
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x21c
push esi
mov esi, dword [esp + 0x228]
push str..bmp
push esi
call fcn.00489890
add esp, 8
test al, al
je 0x41173e
push ebx
push edi
mov edi, dword [esp + 0x22c]
mov ecx, dword [edi + 0x1c]
xor eax, eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
push eax
push 0x80
push 2
push eax
mov dword [esp + 0x2a], eax
push eax
mov word [esp + 0x24], 0x4d42
mov dword [esp + 0x2e], 0x36
mov edx, dword [ecx + 0x14]
push 0x40000000
add edx, 0x36
push esi
mov dword [esp + 0x2e], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0xe
lea ecx, [esp + 0x1c]
push ecx
push esi
call ebx
mov eax, dword [edi + 0x1c]
push 0
lea edx, [esp + 0x10]
push edx
push 0x28
push eax
push esi
call ebx
mov edx, dword [edi + 0x1c]
mov eax, dword [edx + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x18]
push eax
push ecx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
add esp, 0x21c
ret 8
push str..png
push esi
call fcn.00489890
add esp, 8
test al, al
je 0x4117c3
lea edx, [esp + 8]
push edx
push str.image_png
call fcn.004115c0
add esp, 8
test al, al
je 0x4117c3
push 0xf
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [esp + 0x224]
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 4]
push edx
push eax
push ecx
mov dword [esp + 0x10], 0
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [esp + 4]
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
call sub.gdiplus.dll_GdipSaveImageToFile
push esi
mov dword [esp + 8], eax
call sub.gdiplus.dll_GdipDisposeImage
pop esi
add esp, 0x21c
ret 8
Function at 0x4175c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi], eax
je 0x41762e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.cmd_tsplit
push eax
call edi
mov ecx, dword [esi]
push str.cmd_split
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.cmd_splitd
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.cmd_getargc
push eax
call edi
mov ecx, dword [esi]
push str.cmd_getargv
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.cmd_checkoption
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
ret 4
mov eax, esi
pop esi
ret 4
Function at 0x421980
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x2068]
xor eax, eax
mov ecx, 0x800
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x4068]
mov ecx, 0x20
or edx, 0xffffffff
mov dword [eax + 0x80], edx
mov dword [eax], edx
add eax, 4
dec ecx
jne 0x4219a5
lea eax, [ebx + 0x68]
mov edx, 0x10
xor edi, edi
mov ecx, 0x40
mov dword [eax + 0x1000], edi
mov dword [eax], edi
add eax, 4
dec ecx
jne 0x4219c2
dec edx
jne 0x4219bd
xor eax, eax
mov ecx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
push edi
mov dword [ecx + 8], eax
push edi
mov dword [ecx + 0xc], eax
push edi
mov dword [ebx + 0x64], 0x3f
call fcn.00421bf0
cmp dword [esi], edi
jne 0x421a39
push ebp
mov ecx, 0x37f1
mov edi, esi
mov dword [esp + 0x10], 0x800
xor edx, edx
mov esi, 0x20
mov eax, ecx
and eax, 1
mov ebp, ecx
lea edx, [eax + edx*2]
shl eax, 2
and ebp, 4
xor eax, ebp
shl eax, 0xe
sar ecx, 1
or ecx, eax
dec esi
jne 0x421a0c
mov eax, dword [esp + 0x10]
mov dword [edi], edx
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x421a05
pop ebp
push 0x1f40
push 0x3cf000
mov ecx, ebx
call fcn.00421af0
xor esi, esi
push 0
push esi
mov ecx, ebx
call fcn.00421e20
inc esi
cmp esi, 0xe
jl 0x421a4c
push 0xff
push 7
mov ecx, ebx
call fcn.00421e20
push 0xff
push 0xe
mov ecx, ebx
call fcn.00421e20
push 0xff
push 0xf
mov ecx, ebx
call fcn.00421e20
lea eax, [ebx + 0x68]
pop edi
lea ecx, [ebx + 0x1068]
mov dword [ebx + 0x10], eax
pop esi
mov dword [ebx + 0x14], ecx
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x42a220
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x481250]
neg al
push edi
sbb eax, eax
and eax, 3
mov edi, eax
mov eax, 0xffff
jle 0x42a25e
xor ecx, ecx
mov cl, ah
xor edx, edx
mov dh, al
xor eax, eax
and ecx, 0xff
xor ecx, 0xa1
mov ax, word [ecx*2 + 0x4ae0e8]
xor ax, dx
dec edi
jne 0x42a23a
mov edi, dword [esp + 0xc]
xor ecx, ecx
mov cl, ah
xor edx, edx
mov dh, al
and ecx, 0xff
xor ecx, 0xfe
mov ax, word [ecx*2 + 0x4ae0e8]
mov cl, byte [edi]
xor ax, dx
mov byte [esi + 0x483268], cl
mov dl, byte [edi + 1]
mov byte [esi + 0x483269], dl
mov cl, byte [edi + 2]
mov byte [esi + 0x48326a], cl
mov dl, byte [edi + 3]
xor ecx, ecx
mov cl, ah
mov byte [esi + 0x48326b], dl
xor edx, edx
mov dl, byte [edi]
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dh, al
mov ax, word [ecx*2 + 0x4ae0e8]
xor ecx, ecx
xor ax, dx
xor edx, edx
mov dl, byte [edi + 1]
mov cl, ah
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dh, al
mov ax, word [ecx*2 + 0x4ae0e8]
xor ecx, ecx
xor ax, dx
xor edx, edx
mov dl, byte [edi + 2]
mov cl, ah
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dh, al
mov ax, word [ecx*2 + 0x4ae0e8]
xor ecx, ecx
xor ax, dx
xor edx, edx
mov dl, byte [edi + 3]
mov cl, ah
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dh, al
mov ax, word [ecx*2 + 0x4ae0e8]
xor ecx, ecx
xor ax, dx
mov cl, ah
mov byte [esi + 0x48326c], cl
mov byte [esi + 0x48326d], al
mov cl, byte [edi + 6]
xor al, al
cmp cl, al
sete dl
mov byte [esi + 0x48326e], dl
cmp byte [edi + 7], al
setne cl
mov byte [esi + 0x48326f], cl
mov dl, byte [edi + 8]
and dl, 0xf0
cmp dl, 0xa0
sete cl
mov byte [esi + 0x483270], cl
mov dl, byte [edi + 8]
and dl, 0xf0
cmp dl, 0xb0
sete cl
mov byte [esi + 0x483271], cl
lea edx, [edi + 0x10]
mov dword [esi + 0x48325c], edx
mov cl, byte [edi + 0xe]
mov byte [esi + 0x483264], cl
mov dl, byte [edi + 0xf]
pop edi
mov byte [esi + 0x483265], dl
mov byte [esi + 0x483267], al
mov byte [esi + 0x483266], al
pop esi
ret 4
Function at 0x42a420
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
mov edx, dword [esp + 8]
jne 0x42a43e
cmp edx, 0xffffffff
jne 0x42a43e
mov eax, dword [ecx + 0x481254]
mov edx, dword [ecx + 0x481258]
push ebx
xor ebx, ebx
cmp byte [ecx + 0x40021e], bl
jne 0x42a44f
and edx, 1
lea eax, [edx + eax*2]
cmp eax, ebx
jl 0x42a53b
cmp eax, 0xa4
jge 0x42a53b
mov dl, byte [ecx + eax*4 + 0x24]
mov byte [esp + 0xc], dl
mov dl, byte [ecx + eax*4 + 0x25]
mov byte [esp + 0xd], dl
mov dl, byte [ecx + eax*4 + 0x26]
mov al, byte [ecx + eax*4 + 0x27]
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], al
mov eax, dword [esp + 0xc]
cmp eax, 0x20
jb 0x42a53b
cmp eax, 0x400000
jae 0x42a53b
mov dl, byte [eax + ecx + 9]
lea eax, [eax + ecx + 4]
mov cl, byte [eax + 4]
mov byte [esp + 0xc], cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0xd], dl
mov byte [esp + 0xf], bl
mov byte [esp + 0xe], bl
cmp ecx, dword [esp + 0xc]
jge 0x42a53b
cmp ecx, ebx
jle 0x42a4e4
mov byte [esp + 0xf], bl
mov byte [esp + 0xe], bl
dec ecx
mov dl, byte [eax + 0xe]
mov byte [esp + 0xc], dl
mov dl, byte [eax + 0xf]
mov byte [esp + 0xd], dl
mov edx, dword [esp + 0xc]
lea eax, [eax + edx + 0x10]
jne 0x42a4cb
mov cl, byte [eax + 0xe]
mov dl, byte [eax + 0xf]
mov byte [esp + 0xc], cl
mov cl, byte [eax]
mov byte [esp + 0xd], dl
mov edx, dword [esp + 0x14]
mov byte [edx], cl
mov cl, byte [eax + 1]
mov edx, dword [esp + 0x18]
mov byte [edx], cl
mov cl, byte [eax + 2]
mov edx, dword [esp + 0x1c]
mov byte [edx], cl
mov cl, byte [eax + 3]
mov edx, dword [esp + 0x20]
mov byte [edx], cl
mov cl, byte [eax + 6]
mov edx, dword [esp + 0x28]
cmp cl, bl
mov ecx, dword [esp + 0x24]
sete al
mov byte [ecx], al
mov byte [esp + 0xf], bl
mov byte [esp + 0xe], bl
mov eax, dword [esp + 0xc]
mov dword [edx], eax
mov al, 1
pop ebx
ret 0x24
xor al, al
pop ebx
ret 0x24
Function at 0x439870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a83eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [ecx + 0xb4]
push ebx
lea ebx, [ecx + 0x30]
push esi
push edi
xor eax, eax
mov ecx, 0x400
mov edi, ebx
push 0x114
rep stosd dword es:[edi], eax
call fcn.00496f9b
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4398c5
mov ecx, eax
call fcn.0048b760
mov esi, eax
jmp 0x4398c7
xor esi, esi
mov eax, dword [esp + 0x20]
push 1
push eax
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.0048b7c0
test al, al
je 0x4398f7
push 1
push 0x1000
push ebx
mov ecx, esi
call fcn.0048c290
mov ecx, esi
call fcn.0048bcb0
test esi, esi
je 0x43990b
mov ecx, esi
call fcn.0048bcb0
push esi
call fcn.0048d4e6
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4895b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x8d81d8]
mov ecx, dword [esp + 4]
sub esp, 0x104
push esi
mov esi, eax
and esi, 7
inc eax
push edi
mov dword [0x8d81d8], eax
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00498b1e
mov dl, byte [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x489614
cmp dl, 0x41
jl 0x489603
cmp dl, 0x5a
jle 0x48960d
cmp dl, 0x61
jl 0x489614
cmp dl, 0x7a
jg 0x489614
cmp byte [esp + 9], 0x3a
je 0x489631
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jbe 0x48966b
cmp dl, 0x2f
je 0x489631
cmp dl, 0x5c
jne 0x48966b
mov eax, esi
shl eax, 6
add eax, esi
or ecx, 0xffffffff
lea edx, [eax*4 + 0x8d75b0]
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edx
pop esi
add esp, 0x104
ret
mov al, byte [0x8d81d1]
test al, al
jne 0x4896b6
push 0x8cd42c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x8cd42c
repne scasb al, byte es:[edi]
not ecx
mov al, byte [ecx + 0x8cd42a]
dec ecx
cmp al, 0x5c
je 0x4896af
cmp al, 0x2f
je 0x4896af
mov byte [ecx + 0x8cd42c], 0x5c
mov byte [ecx + 0x8cd42d], 0
mov byte [0x8d81d1], 1
lea edx, [esp + 8]
push edx
mov ecx, esi
push 0x8cd42c
shl ecx, 6
add ecx, esi
push str._s_s
lea esi, [ecx*4 + 0x8d75b0]
push 0x104
push esi
call fcn.004893a0
add esp, 0x14
pop edi
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x489a70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [0x8d81ec]
test al, al
push esi
jne 0x489aaf
xor edx, edx
mov ecx, 0x8d7dd0
mov eax, edx
mov esi, 8
test al, 1
je 0x489a95
shr eax, 1
xor eax, 0xedb88320
jmp 0x489a97
shr eax, 1
dec esi
jne 0x489a88
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x8d81d0
jl 0x489a81
mov byte [0x8d81ec], 1
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x489ae4
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ecx + edi]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor edx, ebx
mov edx, dword [edx*4 + 0x8d7dd0]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x489ac2
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x48b770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48b783
xor al, al
ret
not eax
shr eax, 4
and eax, 1
ret

Function at 0x48b790
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
ret

Function at 0x48ddd0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esi], 0
mov ecx, dword [esi]
mov eax, edi
sub eax, ecx
cmp eax, 0x40000000
jbe 0x48ddfc
mov eax, 0x40000000
push eax
mov eax, dword [ebp + 0x14]
add ecx, ebx
push ecx
push eax
call fcn.0049df51
add esp, 0xc
test eax, eax
jle 0x48de1e
mov edx, dword [esi]
add edx, eax
mov ecx, edx
cmp ecx, edi
mov dword [esi], edx
jb 0x48ddea
test eax, eax
jge 0x48de41
call fcn.0049985d
mov ecx, dword [eax]
push ecx
call fcn.0049979a
push eax
push 0xffffffffffffffff
push ebp
call fcn.0048dbc0
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
jne 0x48de4a
mov dword [ebp + 0x40], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4974e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x497503
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004997ea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x497526
test byte [esp + 8], 2
je 0x497526
call fcn.0049985d
mov dword [eax], 0xd
call fcn.00499866
mov dword [eax], 5
jmp 0x4974ff
xor eax, eax
ret