joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push edi
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 0x214], 0
push edi
push str.SoftwareClientsStartMenuInternet
push 0x80000001
mov dword [ebp - 0x218], 0
call esi
mov ebx, eax
lea eax, [ebp - 0x218]
push eax
push 0x20019
push edi
push str.SoftwareClientsStartMenuInternet
push 0x80000002
mov dword [ebp - 0x21c], ebx
call esi
mov dword [ebp - 0x220], eax
test eax, eax
je 0x404ede
test ebx, ebx
jne 0x405061
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x210]
xor esi, esi
mov dword [ebp - 0x210], 0x104
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
call ebx
test eax, eax
jne 0x404f94
lea eax, [ebp - 0x20c]
push str.Supermium
push eax
call fcn.00406ca2
add esp, 8
test eax, eax
jne 0x404f43
lea eax, [ebp - 0x20c]
push str.Supemium
push eax
call fcn.00406ca2
add esp, 8
test eax, eax
je 0x404f5e
mov ecx, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
call fcn.00404db0
mov edi, eax
test edi, edi
jne 0x405035
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
inc esi
push eax
push esi
push dword [ebp - 0x214]
call ebx
test eax, eax
je 0x404f13
test edi, edi
jne 0x405035
xor esi, esi
mov dword [ebp - 0x210], 0x104
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x218]
call ebx
test eax, eax
jne 0x405035
nop
lea eax, [ebp - 0x20c]
push str.Supermium
push eax
call fcn.00406ca2
add esp, 8
test eax, eax
jne 0x404ff0
lea eax, [ebp - 0x20c]
push str.Supemium
push eax
call fcn.00406ca2
add esp, 8
test eax, eax
je 0x405007
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x20c]
call fcn.00404db0
mov edi, eax
test edi, edi
jne 0x405035
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
inc esi
push eax
push esi
push dword [ebp - 0x218]
call ebx
test eax, eax
je 0x404fc0
cmp dword [ebp - 0x21c], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40504c
push dword [ebp - 0x214]
call esi
cmp dword [ebp - 0x220], 0
jne 0x40505d
push dword [ebp - 0x218]
call esi
test edi, edi
jne 0x405074
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
movzx eax, word [edi]
xor ecx, ecx
xor edx, edx
mov esi, eax
test ax, ax
je 0x405098
cmp si, 0x5c
mov eax, ecx
movzx esi, word [edi + ecx*2 + 2]
cmovne eax, edx
inc ecx
mov edx, eax
test si, si
jne 0x405082
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [edi + edx*2], ax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.00405b56
mov esp, ebp
pop ebp
ret
Function at 0x4063df
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40641e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40641e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40641e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40641e
cmp dword [ecx + 0x74], 0xe
jbe 0x40641e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40c2b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c355
push ebx
push esi
call fcn.0040c281
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c215
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c302
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c354
push edi
push eax
call fcn.0040ac1b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c322
call fcn.0040ad76
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c353
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c215
add esp, 0x20
test eax, eax
jne 0x40c341
push edi
call fcn.0040ad76
jmp 0x40c349
push ebx
call fcn.0040ad76
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d564
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416070
push 0x416068
push str.FlsAlloc
push 0x1f
call fcn.0040d423
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d598
push dword [ebp + 8]
mov ecx, esi
call dword [0x414158]
call esi
jmp 0x40d59e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d5e2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416080
push 0x416078
push str.FlsGetValue
push 0x21
call fcn.0040d423
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d619
push dword [ebp + 8]
mov ecx, esi
call dword [0x414158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d621
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416088
push 0x416080
push str.FlsSetValue
push 0x22
call fcn.0040d423
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d65b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412a20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412a4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412a4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40bf20
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x30], 0x2b
mov dword [ebp - 0x24], 0x25
mov dword [ebp - 0xc], 0x31
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], 0x50
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0x29
mov dword [ebp - 0x40], 0xd
mov dword [ebp - 0x44], 0x28
mov dword [ebp - 0x18], 0x22
mov dword [ebp - 8], 0x3b
mov dword [ebp - 0x48], 0x59
mov dword [ebp - 0x4c], 0x10
mov dword [ebp - 0x50], 0x4f
mov dword [ebp - 0x54], 0x13
mov dword [ebp - 0x58], 0x13
mov dword [ebp - 0x5c], 0x45
mov dword [ebp - 0x60], 0x4e
mov dword [ebp - 0x28], 0x2f
mov dword [ebp - 0x64], 0x3f
mov dword [ebp - 0x68], 0x1d
mov dword [ebp - 0x6c], 0x54
mov dword [ebp - 0x70], 0x26
mov eax, dword [ebp + 8]
sub eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x35
push edx
call fcn.0041a6f0
add esp, 8
mov dword [ebp - 4], 0
jmp 0x40bfff
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x186f0
cmp dword [ebp - 4], ecx
jge 0x40c085
push 0xeaa4
push 0x2f53
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0xc]
jge 0x40c031
mov dword [ebp - 0x10], 1
jmp 0x40c038
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x24]
jge 0x40c052
mov dword [ebp - 0x14], 1
jmp 0x40c059
mov dword [ebp - 0x14], 0
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x28]
and edx, dword [ebp - 0x10]
and edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
cmp dword [ebp - 0x2c], 0
je 0x40c080
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40bff6
call fcn.004287f0
mov esp, ebp
pop ebp
ret
Function at 0x40ef60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x58], 0x37
mov dword [ebp - 0x44], 0x5e
mov dword [ebp - 0x10], 0x12
mov dword [ebp - 0x24], 0x5a
mov dword [ebp - 0x5c], 0x2f
mov dword [ebp - 0x50], 0x1f
mov dword [ebp - 0x60], 0xb
mov dword [ebp - 0xc], 0x1b
mov dword [ebp - 0x64], 0x1e
mov dword [ebp - 0x48], 0x36
mov dword [ebp - 0x68], 0x51
mov dword [ebp - 0x6c], 0x39
mov dword [ebp - 0x3c], 0x4b
mov dword [ebp - 0x40], 0x13
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], 0x32
mov dword [ebp - 0x2c], 0x61
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x4c], 0x33
mov dword [ebp - 0x74], 0x5c
mov dword [ebp - 0x78], 0x50
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x7c], 0x43
mov dword [ebp - 8], 0
jmp 0x40f020
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x186d2
cmp dword [ebp - 8], ecx
jge 0x40f0df
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x30], 0
je 0x40f0da
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x38]
jge 0x40f074
mov dword [ebp - 0x1c], 1
jmp 0x40f07b
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 4]
jge 0x40f08c
mov dword [ebp - 0x20], 1
jmp 0x40f093
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
je 0x40f0da
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0xe47b
push 0x65fc
push 0x16e09
push 0x9e26
push 0xece3
push 0x15156
push 0xa4fe
push 0x62c2
push 0xd030
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 0x24
jmp 0x40f017
mov dword [ebp - 0x14], 0
jmp 0x40f0f1
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x40]
sub eax, 0x12
cmp dword [ebp - 0x14], eax
jge 0x40f107
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x40f0e8
mov edx, dword [ebp - 0x44]
sub edx, 0x4c
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0x12
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x36
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x25
push edx
mov eax, dword [ebp - 0x48]
add eax, 1
push eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x2b
push ecx
mov edx, dword [ebp - 0x50]
add edx, 0x23
push edx
mov eax, dword [ebp - 0x54]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x1d
push ecx
call fcn.0041b300
add esp, 0x24
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov esp, ebp
pop ebp
ret
Function at 0x410c10
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x30], 0x48
mov dword [ebp - 0x28], 0x17
mov dword [ebp - 0x34], 0x43
mov dword [ebp - 0x38], 0x25
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0x26
mov dword [ebp - 0x44], 0x4c
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x20], 0xe
mov dword [ebp - 0x4c], 0x3a
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x50], 0x5f
mov dword [ebp - 0x54], 0x29
mov dword [ebp - 0x58], 0x37
mov dword [ebp - 0x5c], 0x37
mov dword [ebp - 0x60], 0x3a
mov dword [ebp - 0x2c], 0x5b
mov dword [ebp - 0x18], 0x3b
mov dword [ebp - 8], 0x37
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x14], 0x31
mov dword [ebp - 4], 0
jmp 0x410cc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x186d1
cmp dword [ebp - 4], ecx
jge 0x410cf3
push 0x63f4
push 0x17a6e
push 0xf159
call dword [sym.imp.WS2_32.dll_getaddrinfo]
add esp, 0xc
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x410cb9
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x410d08
mov dword [ebp - 0xc], 1
jmp 0x410d0f
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jge 0x410d20
mov dword [ebp - 0x10], 1
jmp 0x410d27
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x2c]
and edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x10]
or edx, eax
je 0x410d40
mov ecx, dword [ebp + 0x20]
add ecx, 1
mov dword [ebp + 0x20], ecx
mov esp, ebp
pop ebp
ret
Function at 0x415860
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x2c], 0x11
mov dword [ebp - 0x30], 0x5b
mov dword [ebp - 0x34], 0x42
mov dword [ebp - 0x38], 0x44
mov dword [ebp - 0x3c], 0x5c
mov dword [ebp - 0x40], 0x3f
mov dword [ebp - 0x44], 0x48
mov dword [ebp - 0x48], 0x26
mov dword [ebp - 0x1c], 0x4f
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x14], 0x42
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x24], 0x1a
mov dword [ebp - 0x58], 0x61
mov dword [ebp - 0x5c], 0x14
mov dword [ebp - 0x28], 0x59
mov dword [ebp - 0x18], 0x1e
mov dword [ebp - 0x60], 0x4a
mov dword [ebp - 0x64], 0x39
mov dword [ebp - 0x68], 2
mov dword [ebp - 0x20], 0x1b
mov dword [ebp - 0xc], 0x46
mov dword [ebp - 0x6c], 0x52
mov dword [ebp - 4], 0
jmp 0x415920
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1a
cmp dword [ebp - 4], ecx
jge 0x415941
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp + 0x20]
test edx, edx
je 0x41593f
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x415917
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x41595c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x186f9
cmp dword [ebp - 8], eax
jge 0x415991
push 0xe1a9
push 0x1060
push 0xcc5e
push 0xdc0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x415953
mov dword [ebp - 0x10], 0
jmp 0x4159a3
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x186e7
cmp dword [ebp - 0x10], eax
jge 0x4159ec
push 0xc6f6
push 0x2979
push 0x726
push 0xaf87
push 0xdbad
push 0x7bae
push 0x15acf
push 0x272b
call dword [sym.imp.USER32.dll_GetWindowLongA]
add esp, 0x20
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x41599a
mov esp, ebp
pop ebp
ret
Function at 0x418150
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x10], 0x5a
mov dword [ebp - 0x2c], 0x34
mov dword [ebp - 0x38], 0x23
mov dword [ebp - 0x3c], 0x1e
mov dword [ebp - 0x40], 0x1c
mov dword [ebp - 0x44], 0x31
mov dword [ebp - 0x48], 0xa
mov dword [ebp - 0x4c], 0x4e
mov dword [ebp - 0x50], 0x4b
mov dword [ebp - 0x54], 0x3d
mov dword [ebp - 0x58], 0x10
mov dword [ebp - 0x24], 0x53
mov dword [ebp - 0x20], 0x64
mov dword [ebp - 0x5c], 0x54
mov dword [ebp - 0x28], 0x33
mov dword [ebp - 0x14], 0x4d
mov dword [ebp - 0x60], 0x1f
mov dword [ebp - 0x64], 0x33
mov dword [ebp - 0x68], 0x1f
mov dword [ebp - 0x6c], 0x46
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x1c], 0x2a
mov dword [ebp - 8], 0
jmp 0x418209
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x186c6
cmp dword [ebp - 8], ecx
jge 0x418228
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x418200
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x1c]
jge 0x418239
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
jmp 0x41824b
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x63
cmp dword [ebp - 0xc], eax
jge 0x418286
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
je 0x418284
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x34]
jge 0x418284
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x418242
mov esp, ebp
pop ebp
ret

Function at 0x418b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], 0x32
mov dword [ebp - 0x20], 0x2f
mov dword [ebp - 0x24], 0x45
mov dword [ebp - 0xc], 0x3d
mov dword [ebp - 0x28], 0x17
mov dword [ebp - 0x2c], 0x4d
mov dword [ebp - 0x30], 0x23
mov dword [ebp - 0x34], 0x45
mov dword [ebp - 0x38], 0x1a
mov dword [ebp - 0x14], 0x4f
mov dword [ebp - 0x3c], 0x5d
mov dword [ebp - 0x10], 0x61
mov dword [ebp - 0x40], 0x5a
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x48], 0x3b
mov dword [ebp - 0x4c], 0x1d
mov dword [ebp - 8], 0x54
mov dword [ebp - 0x50], 0x3d
mov dword [ebp - 0x54], 0x28
mov dword [ebp - 0x58], 0x52
mov dword [ebp - 0x5c], 0x34
mov dword [ebp - 4], 0
jmp 0x418c32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x186dd
cmp dword [ebp - 4], ecx
jge 0x418c51
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x418c29
mov eax, dword [ebp - 0x10]
sub eax, 0x29
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x37
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x2e
push edx
mov eax, dword [ebp + 8]
add eax, 0x46
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x51
push ecx
call fcn.00429c40
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x41ae50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x58], 0x2f
mov dword [ebp - 0x2c], 0x23
mov dword [ebp - 0x5c], 0x59
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x40], 0x26
mov dword [ebp - 0x28], 0x51
mov dword [ebp - 0x1c], 0x45
mov dword [ebp - 0x60], 0x50
mov dword [ebp - 0x38], 0x27
mov dword [ebp - 0x3c], 0x2e
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x44], 0x53
mov dword [ebp - 0x10], 0x45
mov dword [ebp - 0x24], 0x16
mov dword [ebp - 0x68], 0x60
mov dword [ebp - 0x6c], 4
mov dword [ebp - 4], 0x59
mov dword [ebp - 0x54], 0x63
mov dword [ebp - 0x70], 0xe
mov dword [ebp - 0x48], 0x52
mov dword [ebp - 0x74], 0x16
mov dword [ebp - 8], 0
jmp 0x41af02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x186b6
cmp dword [ebp - 8], ecx
jge 0x41af9d
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jge 0x41af25
mov dword [ebp - 0x14], 1
jmp 0x41af2c
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jge 0x41af52
mov dword [ebp - 0x18], 1
jmp 0x41af59
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x38]
and ecx, dword [ebp - 0x3c]
and ecx, dword [ebp - 0x14]
and ecx, dword [ebp - 0x18]
je 0x41af98
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp + 0x10]
jge 0x41af98
mov eax, dword [ebp - 0x44]
or eax, dword [ebp - 4]
je 0x41af98
push 0x1566e
push 0x1298
push 0xea77
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x41aef9
mov dword [ebp - 0xc], 0
jmp 0x41afaf
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x48]
sub eax, 0x186f2
cmp dword [ebp - 0xc], eax
jge 0x41b02b
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x4c]
jge 0x41afcd
mov dword [ebp - 0x20], 1
jmp 0x41afd4
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x50]
and edx, dword [ebp - 0x20]
je 0x41aff0
mov eax, dword [ebp - 0x54]
and eax, dword [ebp + 0x10]
je 0x41aff0
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
push 0x15dd4
push 0x79b3
push 0x12fc4
push 0x91f
push 0x296c
push 0x662e
push 0x14123
push 0x12c97
push 0x1b17
call dword [sym.imp.USER32.dll_RemovePropA]
add esp, 0x24
jmp 0x41afa6
mov esp, ebp
pop ebp
ret
Function at 0x429c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x48], 0x10
mov dword [ebp - 0x3c], 0x3b
mov dword [ebp - 0x28], 0x3b
mov dword [ebp - 0x4c], 0x4b
mov dword [ebp - 0x50], 0x38
mov dword [ebp - 0x54], 0xa
mov dword [ebp - 0x30], 0x13
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x44], 0x58
mov dword [ebp - 0x58], 0x49
mov dword [ebp - 0x5c], 0x2a
mov dword [ebp - 0x60], 0x50
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x68], 0x5b
mov dword [ebp - 0x14], 0x17
mov dword [ebp - 0x6c], 0x31
mov dword [ebp - 0x2c], 0x50
mov dword [ebp - 0x70], 0x56
mov dword [ebp - 0xc], 0x59
mov dword [ebp - 0x40], 0x46
mov dword [ebp - 0x74], 0x58
mov dword [ebp - 0x78], 0x5c
mov dword [ebp - 0x7c], 0x13
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x429d02
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x186db
cmp dword [ebp - 8], edx
jge 0x429db3
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x18]
jge 0x429d25
mov dword [ebp - 0x18], 1
jmp 0x429d2c
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jge 0x429d3d
mov dword [ebp - 0x1c], 1
jmp 0x429d44
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
je 0x429dae
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x18]
add edx, 1
mov dword [ebp + 0x18], edx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jge 0x429d75
mov dword [ebp - 0x20], 1
jmp 0x429d7c
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x40]
jge 0x429d90
mov dword [ebp - 0x24], 1
jmp 0x429d97
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
je 0x429dae
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x429cf9
mov dword [ebp - 0x10], 0
jmp 0x429dc5
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x57
cmp dword [ebp - 0x10], edx
jge 0x429ddb
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x429dbc
mov esp, ebp
pop ebp
ret
Function at 0x6ea253
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6ea292
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6ea292
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6ea292
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6ea292
cmp dword [ecx + 0x74], 0xe
jbe 0x6ea292
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x6f6904
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6f6943
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6f6943
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6f6943
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6f6943
cmp dword [ecx + 0x74], 0xe
jbe 0x6f6943
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x716589
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0071645d