joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d4a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10023240
call fcn.1002158d
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1001d687
push edi
call dword [sym.imp.MSVCR120.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10021d82
add esp, 0x10
test eax, eax
js 0x1001d681
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1001d545
push esi
call fcn.1001820c
pop ecx
test al, al
je 0x1001d545
mov eax, esi
call fcn.100215f0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1001d551
push esi
lea ecx, [ebp - 0x428]
call fcn.10021d82
push 3
push esi
push edi
push eax
call fcn.10021d82
mov esi, eax
test esi, esi
je 0x1001d681
push 0x60
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x1001d59d
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], eax
test edi, edi
jne 0x1001d59d
call fcn.10014255
mov esi, eax
jmp 0x1001d666
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x1001d5c0
call fcn.10014255
jmp 0x1001d659
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1001d5b6
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1001d5f0
mov esi, 0x8007000e
jmp 0x1001d65b
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10021d82
jmp 0x1001d616
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1001d5e9
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.10021d82
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
add esp, 0x10
mov byte [eax + esi], bl
push dword [ebp + 0x14]
push dword [ebp - 0x418]
call fcn.10021d82
mov esi, eax
test edi, edi
je 0x1001d666
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001d6a1
lea ecx, [ebp - 0x418]
call fcn.1001cc70
jmp 0x1001d6a1
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1001d69c
lea ecx, [ebp - 0x418]
call fcn.1001cc70
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.100131e8
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.100214df
ret 0x10
Function at 0x10021d82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10021d91
pop dword [ebp - 0x44]
mov eax, 0x95aec5d8
add eax, 0x7a5357b9
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a00c
push 0
mov eax, 0xac2c44d3
sub eax, 0x9c2a0373
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x12553c0e
add ecx, 0xedab0bf7
mov esi, eax
mov edx, 0x40b5460c
add edx, 0xcf4e3ff4
add edx, dword [ebp - 0x44]
mov edi, 0x4c21c108
sub dword [ebp - 8], ebx
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x44be4559
xor ebx, edi
xor dword [ebp - 0x20], ebx
mov dword [esi], ebx
add dword [ebp - 0x38], 0xa5246fb0
add esi, 0x3228697f
sub esi, 0x3228697b
add edx, 4
loop 0x10021dea
add eax, 0x112e7
xor ebx, ebx
add ebx, eax
add eax, 0xa6963125
sub eax, 0xa6963120
mov ecx, 0x33b91fd8
sub ecx, 0x23b91fd8
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10020ff5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10021004
pop dword [ebp - 0x20]
mov eax, 0x10021004
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xfec16893
add dword [ebp - 0x30], 0x4f90dcb8
mov dword [ebp - 0x2c], 0x2a0384c0
add dword [ebp - 0x2c], 0x82fc785
mov dword [ebp - 0x28], 0xe7b5c6a
add dword [ebp - 0x28], 0x3dd0e7c4
mov dword [ebp - 0x24], 0x9aaef35e
sub dword [ebp - 0x24], 0x9aaef35e
lea eax, [ebp - 0x30]
push eax
mov eax, 0x3663d2dc
add eax, 0xd99e4d68
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xc2f416e0
add dword [ebp - 0x30], 0xb17e5276
mov dword [ebp - 0x2c], 0xdff593a0
sub dword [ebp - 0x2c], 0x9e89322b
mov dword [ebp - 0x28], 0x17f029de
add dword [ebp - 0x28], 0x4b7f428e
mov dword [ebp - 0x24], 0x344799a9
sub dword [ebp - 0x24], 0x344799a9
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x21fc8e42
add eax, 0xee0591fe
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd4a
push 0
call eax
mov ecx, 0x29dbb246
sub ecx, 0x29db5b62
mov edx, eax
mov ebx, 0x750b9d2
sub ebx, 0xf74d9dd2
add ebx, dword [ebp - 0x20]
mov edi, 0x606411c9
sub dword [ebp - 0x1c], 0xa13d28d2
mov esi, dword [ebx]
mov dword [ebp - 0x1c], 0xac79eb5
sub esi, edi
xor dword [ebp - 0x1c], esi
mov dword [edx], esi
mov dword [ebp - 0xc], 0x8399b6da
add edx, 0xe304702c
sub edx, 0xe3047028
add ebx, 4
loop 0x1002111b
add eax, 0x14e63
xor ebx, ebx
add ebx, eax
add eax, 0x923c67d5
sub eax, 0x923c67d0
mov ecx, 0xcd97423c
add ecx, 0x4268bdc4
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x416830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41684a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416840
mov eax, 1
add ebx, ebx
jne 0x416863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416858
jne 0x416874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416858
xor ecx, ecx
sub eax, 3
jb 0x416888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4168fa
mov ebp, eax
add ebx, ebx
jne 0x416893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4168a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4168c4
inc ecx
add ebx, ebx
jne 0x4168b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4168a5
jne 0x4168c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4168a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4168e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4168d5
jmp 0x416846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4168e4
add edi, ecx
jmp 0x416846
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41694c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x169f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416901
mov ecx, edi
jns 0x416930
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a7c]
or eax, eax
je 0x416946
mov dword [ebx], eax
add ebx, 4
jmp 0x41691e
call dword [esi + 0x16a78]
mov ebp, dword [esi + 0x16a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416980
sub esp, 0xffffff80
jmp 0x404843

Function at 0x414ddd
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [edx], ecx
add edx, 4
sub eax, 0xf712e726
cmp edx, esi
jne fcn.00414ddd
dec edi
push edi
mov eax, dword [esp]
add esp, 4
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4011b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor bl, bl
cmp byte [eax], 0x2e
jne 0x401209
lea ecx, [esp + 8]
push ecx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401209
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4011fe
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
ret 0xc
Function at 0x401930
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a3c
call fcn.00425180
push ebx
push ebp
push esi
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x3c
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1a58]
lea eax, [esp + 0x1a5c]
push eax
lea edx, [esp + 0x250]
push ecx
push edx
xor ebx, ebx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov esi, dword [esp + 0x1a54]
mov cl, 0x5c
cmp byte [esi], cl
jne 0x4019bd
cmp byte [esi + 1], cl
jne 0x4019bd
cmp byte [esi + 2], 0x3f
jne 0x4019b6
cmp byte [esi + 3], cl
jne 0x4019bd
mov al, byte [esi + 4]
cmp al, 0x55
je 0x40199b
cmp al, 0x75
jne 0x4019bd
mov al, byte [esi + 5]
cmp al, 0x4e
je 0x4019a6
cmp al, 0x6e
jne 0x4019bd
mov al, byte [esi + 6]
cmp al, 0x43
je 0x4019b1
cmp al, 0x63
jne 0x4019bd
cmp byte [esi + 7], cl
jne 0x4019bd
mov eax, 1
jmp 0x4019bf
xor eax, eax
neg al
mov edi, dword [esp + 0x1a50]
lea ecx, [esp + 0x14c]
sbb eax, eax
push 0x100
and eax, 0x80
push ecx
or eax, 0x441
push str..exe
mov dword [esp + 0x20], eax
lea eax, [esp + 0x258]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 1
call fcn.004011b0
test al, al
je 0x401a1f
lea edx, [esp + 0x14c]
mov dword [esp + 0x38], edx
jmp 0x401a27
mov dword [esp + 0x38], str.exefile
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401a5b
mov eax, dword [esp + 0x48]
test eax, eax
je 0x401afe
push eax
push edi
call fcn.00401b20
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x401afe
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x4c7
je 0x401afe
push 0
lea edx, [esp + 0x650]
push 0x400
push edx
push 0x400
call ebp
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [esp + 0x4c]
push 0x100
push eax
push 0x3f3
push 0xfffffffffffffffa
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x64c]
lea edx, [esp + 0x24c]
push ecx
push edx
lea eax, [esp + 0x54]
push esi
push eax
lea ecx, [esp + 0xa5c]
push 0x1000
push ecx
call fcn.00413d60
add esp, 0x18
lea edx, [esp + 0xa4c]
push 0x10
push edx
push edi
call fcn.00401100
lea eax, [esp + 0xa4c]
push 0x1000
push eax
call fcn.00401190
lea ecx, [esp + 0x24c]
push 0x400
push ecx
call fcn.00401190
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x1a3c
ret
Function at 0x401b20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push str.PolicyNoTrayIcon
call fcn.00406bf0
test eax, eax
mov ebp, dword [esp + 0x88]
push 0xfffffffffffffffa
push ebp
sete bl
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], 0x58
push 6
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call edi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebp
call edi
test bl, bl
je 0x401bbc
push 1
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 6
call fcn.00415f20
push 0x40
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
je 0x401c55
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x401c3c
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x401c29
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x401c03
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
jne 0x401bf0
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test bl, bl
je 0x401c75
lea eax, [esp + 0x2c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push ebp
call esi
push 9
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 8
Function at 0x403490
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.00406c10
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.004100a0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0xc], eax
jne 0x4034d0
push eax
call fcn.004100c0
test al, al
jne 0x40354c
mov eax, dword [esp + 0xc]
push eax
mov esi, 1
call fcn.004100c0
test al, al
je 0x403505
mov eax, dword [esp + 0xc]
push eax
call fcn.004100d0
test al, al
je 0x4034f2
mov esi, 3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004100e0
test al, al
je 0x40350a
or esi, 4
jmp 0x40350a
mov esi, 7
lea edx, [esp + 0xc]
push edx
push str.http:__ai4rei.net_about_telemetry_
push esi
push ebx
push 0xfffffffffffffffa
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.00410040
test al, al
je 0x4035a1
mov eax, dword [esp + 0xc]
push eax
call fcn.00406c10
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.00410070
test edi, edi
jne 0x4035a1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004100c0
test al, al
je 0x4035a1
mov edx, dword [esp + 0xc]
push edx
call fcn.004100d0
test al, al
jne 0x403576
mov eax, dword [esp + 0xc]
push eax
call fcn.004100e0
test al, al
je 0x4035a1
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
push 0x4035b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4035a1
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret 8

Function at 0x403cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x38
push esi
push str.MediaBackground
call fcn.00406bd0
cmp byte [eax], 0
je 0x403de0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403de0
mov esi, dword [esp + 0x40]
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
push 0xfffffffffffffffa
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x7f00
push 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0x4046f0
mov dword [esp + 0x44], str.BackgroundMediaClass
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
pop edi
je 0x403de0
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [0x43b708]
test al, 1
jne 0x403da4
mov dl, al
push 0x404780
or dl, 1
mov dword [0x43b714], 0
mov byte [0x43b708], dl
mov byte [0x43b718], 0
mov dword [0x43b710], 0x42faa0
call fcn.00425138
add esp, 4
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
push 0x43b710
push edx
mov edx, dword [esp + 0x14]
push 0x6b
sub ecx, eax
push esi
push ecx
mov ecx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
push ecx
push 0x54000000
push 0x42f520
push str.BackgroundMediaClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov al, 1
pop esi
add esp, 0x38
ret
Function at 0x406c20
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x214
push ebx
push 0x431b80
push 0x43b334
xor bl, bl
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041be10
push 0x42ffd8
push str.FontSize
push 0
push str.ROCred
push 0
push 0x43b334
call fcn.0041b650
push 0
push 0x43b334
call fcn.0041ba20
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
push 0x42ffd0
push 0xa
push 0
call fcn.00414530
test eax, eax
je 0x406d70
lea edx, [esp + 0x114]
push 0x104
push edx
call fcn.00414320
test eax, eax
je 0x406d66
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
lea ecx, [esp + 0x120]
push str.rcd
push ecx
call fcn.00414160
test eax, eax
je 0x406d66
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406d66
push esi
push eax
push eax
push 3
push eax
push eax
lea edx, [esp + 0x28]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406d56
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x406d50
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x43b334
call fcn.0041bb80
test al, al
je 0x406d56
push 0
push 0x406db0
push 0x43b334
call fcn.0041b4c0
mov bl, 1
jmp 0x406d56
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
pop esi
jne 0x406d70
xor al, al
pop ebx
add esp, 0x214
ret
push 0x42ffc4
push 0
push 0x104
push 0x43b230
push 0
call fcn.00413f70
test al, al
je 0x406d9b
push 0x43b230
push 0x43b334
call fcn.0041bb80
mov al, 1
pop ebx
add esp, 0x214
ret
Function at 0x40d9e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi]
push edx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40da1b
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
pop esi
mov al, 1
mov dword [ecx], edx
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov al, bl
pop esi
pop ebx
ret 0x10

Function at 0x40da60
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi]
push edx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40da9b
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
pop esi
mov al, 1
mov dword [ecx], edx
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov al, bl
pop esi
pop ebx
ret 0x10

Function at 0x40dc30
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edi
push eax
mov ecx, dword [esi]
xor bl, bl
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40dc73
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x40dc6f
call edi
mov dword [esi + 4], eax
pop edi
mov al, bl
pop esi
pop ebx
add esp, 8
ret 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
pop ebx
add esp, 8
ret 8

Function at 0x40ded0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
xor edx, edx
mov dword [esp + 8], eax
mov dword [ecx + 4], edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [esp + 4], ecx
jmp fcn.0040dc30
Function at 0x413000
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x24
call fcn.0041cc80
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4130be
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x4130b8
push ebx
push ebx
push 1
push ebx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x4130af
mov edi, dword [esp + 0x14]
lea eax, [esi + 0x18]
push eax
push 4
mov ecx, dword [edi + 0x48]
push esi
push 0x4130d0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x4130a6
push esi
call fcn.0040df70
mov dword [esi + 0x20], ebx
lea ebx, [edi + 0x30]
push ebx
mov dword [esi + 8], edi
mov dword [esi + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add edi, 0xc
push esi
push edi
call fcn.0040df90
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
mov eax, dword [esi + 0x10]
mov dword [esi + 0x10], ebx
push eax
call ebp
mov eax, dword [esi + 0xc]
mov dword [esi + 0xc], ebx
push eax
call ebp
push esi
call fcn.0041d130
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4

Function at 0x413b00
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x413b28
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x413bdc
call esi
cmp eax, 3
jne 0x413bdc
push 0x5c
push edi
call fcn.00425c86
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413bdc
mov esi, ebp
sub esi, edi
lea ecx, [esi + 1]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x413bdc
mov ecx, esi
mov esi, edi
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
sub eax, edi
mov byte [eax + ebp], 0
call fcn.00413b00
test eax, eax
jne 0x413baf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x413baf
mov esi, 1
jmp 0x413bb1
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
jne 0x413bdc
mov ecx, dword [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x413b24
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x413c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 5
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 7
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413c8f
or eax, ebx
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
mov ecx, dword [esp + edi*4 + 0x10]
mov edx, dword [esp + 0x24]
push 0
push ebx
push 2
push 0
push ecx
push 0xc0000000
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x413cc5
test esi, esi
jne 0x413cce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x413cce
or esi, 0xffffffff
inc edi
cmp edi, 4
jb 0x413c97
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
xor eax, eax
cmp esi, 0xffffffff
pop esi
pop ebp
pop ebx
setne al
add esp, 0x10
ret 0xc