joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444928
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
jne 0x40782c
xor eax, eax
jmp 0x4079ba
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x40785a
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x40785a
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x4079ba
cmp dword [ebx + 0x4c], 0
jne 0x407868
or eax, 0xffffffff
jmp 0x4079ba
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x407889
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x54]
mov dword [esi], ecx
sub edx, ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
cmp dword [ebx + 0x38], 0
jne 0x4078ae
push dword [ebx + 0x4c]
movsx eax, cl
push eax
call fcn.0042d0fc
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov eax, ecx
jmp 0x4079ba
mov byte [ebp - 0x29], cl
lea eax, [ebp - 0x28]
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x14]
mov esi, dword [ebx + 0x38]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x4079ad
cmp eax, 1
jg 0x40798b
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub esi, eax
je 0x40795c
push dword [ebx + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.00430c3c
add esp, 0x10
cmp esi, eax
jne 0x4079ad
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x29]
mov byte [ebx + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x407986
test esi, esi
jne 0x4078e4
cmp dword [ebp - 0x18], 0x20
jae 0x4079ad
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404990
jmp 0x4078e1
mov ebx, dword [ebp + 8]
jmp 0x4079b0
cmp eax, 3
jne 0x4079ad
push dword [ebx + 0x4c]
movsx eax, byte [ebp - 0x29]
push eax
call fcn.0042d0fc
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x4079b0
or ebx, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404010
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret 4
Function at 0x408380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4444c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4084bb
cmp byte [ebx + 0x3d], 0
je 0x4084bb
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4083d4
xor al, al
jmp 0x4084bd
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop word [eax + eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x408453
sub eax, 1
je 0x408457
sub eax, 2
je 0x4084ad
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00404010
mov al, bl
jmp 0x4084bd
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x40848f
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00430c3c
add esp, 0x10
cmp esi, eax
jne 0x408445
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x4084ad
test esi, esi
jne 0x408410
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404990
jmp 0x408404
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.00404010
mov al, bl
jmp 0x4084bd
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret
Function at 0x408bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44464f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004208b7
mov esi, eax
mov dword [ebp - 0x10], esi
push 1
mov dword [ebp - 4], 0
call fcn.0043faec
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40adc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444c18
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x138], eax
call fcn.00403900
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], 0
mov byte [ebp - 0x150], 0
call fcn.004044d0
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x12c]
cmp dword [ebp - 0x13c], 0x10
mov edx, 0x100
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x150]
cmovae eax, dword [ebp - 0x150]
mov dword [ebp - 0x130], eax
xor eax, eax
nop word [eax + eax]
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jl 0x40ae70
xor dl, dl
mov word [ebp - 0x2c], 0
xor ebx, ebx
lea esi, [ebp - 0x12c]
mov edi, 0x100
mov eax, dword [ebp - 0x130]
lea esi, [esi + 1]
mov cl, byte [esi - 1]
movzx edx, dl
mov al, byte [edx + eax]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [esi - 1], al
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x134]
mov byte [ebp + ebx - 0x12c], cl
sub edi, 1
jne 0x40ae90
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x40af2a
movzx edx, byte [ebp - 0x2c]
movzx ebx, byte [ebp - 0x2b]
nop dword [eax + eax]
inc dl
movzx edx, dl
mov cl, byte [ebp + edx - 0x12c]
add bl, cl
movzx ebx, bl
movzx eax, byte [ebp + ebx - 0x12c]
mov byte [ebp + edx - 0x12c], al
mov byte [ebp + ebx - 0x12c], cl
movzx eax, cl
add al, byte [ebp + edx - 0x12c]
mov ecx, dword [ebp - 0x138]
movzx eax, al
movzx eax, byte [ebp + eax - 0x12c]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x40aee0
lea ecx, [ebp - 0x150]
call fcn.00404010
lea ecx, [ebp - 0x28]
call fcn.00404010
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret 8

Function at 0x40c480
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x40
push esi
push edi
mov esi, 0x454148
mov byte [ebp - 1], 0
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x10]
xor esi, esi
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div edi
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x40c4c0
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c510
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
mov bh, byte [edi + 0x209]
add ecx, eax
mov dword [ebp - 4], esi
sub edx, eax
mov esi, dword [ebp + 0x10]
sub esi, eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x10], esi
cmp eax, ecx
jae 0x40c58a
sub edx, esi
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx esi, al
add esi, edx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 0x10]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp + 0x14]
jb 0x40c550
mov edi, dword [ebp + 8]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00420ba0
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40c940
mov eax, dword [esi]
jmp 0x40c942
mov eax, esi
push 0x40
push 0x455b2c
push ecx
mov byte [eax], 0
call fcn.00431513
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x40c96f
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret 8
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004316ea
add esp, 0x10
test eax, eax
je 0x40c9ba
nop word [eax + eax]
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.00403ea0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004316ea
add esp, 0x10
test eax, eax
jne 0x40c990
push edi
call fcn.004307c2
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.004204ef
mov esp, ebp
pop ebp
ret 8
Function at 0x40db90
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444f48
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x3c], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
xor ecx, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
test eax, eax
je 0x40dcfd
mov edi, dword [ebp + 8]
test edi, edi
je 0x40dcfd
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40dc2e
push eax
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40dcc6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40dcc6
push 0
push edi
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40dcc6
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x38]
push 0
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 4
push dword [ebp - 0x2c]
mov dword [ebp - 0x38], 4
call edi
test eax, eax
je 0x40dcc6
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.00403cf0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push 0
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 2
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x40dcdb
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00402a90
lea ecx, [ebp - 0x28]
call fcn.00402a00
jmp 0x40dd1d
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, esi
call fcn.0040daa0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.00402a00
jmp 0x40dd1d
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00402a90
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x40dd1d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402d60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret
Function at 0x40e060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444748
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
push 0x1c
call fcn.004208b7
mov ecx, dword [ebp + 0x1c]
mov esi, eax
mov dword [ebp - 0x60], esi
add esp, 4
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov dword [esi], str.string
mov dword [esi + 4], edi
mov dword [esi + 8], 0x455a94
mov dword [esi + 0xc], 0x454400
mov dword [esi + 0x10], str.Turbo.cpp
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], 5
cmp byte [edi], 0
mov byte [ebp - 0x5c], 0
jne 0x40e0e5
xor ecx, ecx
jmp 0x40e0f9
mov ecx, edi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e0f0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x5c]
call fcn.004043d0
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
push ecx
lea eax, [ebp - 0x64]
mov ecx, ebx
push eax
call fcn.0040a2e0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.00404010
cmp byte [ebp - 0x60], 0
jne 0x40e1c1
cmp byte [edi], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x40e154
xor ecx, ecx
jmp 0x40e169
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e160
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.004043d0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x2e
push str.more_than_one_flags_defined_with_the_same_name
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004043d0
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040df00
lea ecx, [ebp - 0x28]
call fcn.00404010
lea ecx, [ebp - 0x40]
call fcn.00404010
push 0
call fcn.0042a4a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40eee0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 8], ecx
push edi
mov edx, ecx
xor edi, edi
xor ecx, ecx
xor esi, esi
test ebx, ebx
jle 0x40efd9
nop
mov al, byte [esi + edx]
cmp al, 0x3d
jne 0x40ef0d
inc edi
cmp edi, 2
jg 0x40ef56
cmp al, 0x7f
ja 0x40ef56
movzx eax, al
mov al, byte [eax + 0x454380]
cmp al, 0x7f
je 0x40ef56
cmp al, 0x40
jae 0x40ef26
test edi, edi
jne 0x40ef56
inc esi
inc ecx
cmp esi, ebx
jl 0x40ef00
test ecx, ecx
je 0x40efd9
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 0xc]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x40ef62
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov edi, 3
test esi, esi
jle 0x40efd1
movzx ecx, byte [edx]
mov dl, byte [ecx + 0x454380]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
and ecx, 0x3f
or ebx, ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 4
jne 0x40efc5
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
jle 0x40efb0
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x40efbd
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x40efc5
mov byte [eax], bl
inc eax
mov edx, dword [ebp - 8]
dec esi
inc edx
mov dword [ebp - 8], edx
test esi, esi
jg 0x40ef75
mov ecx, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44515b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00411950
test eax, eax
jne 0x4113c0
mov eax, 1
jmp 0x4114b3
call fcn.00411720
push 0x38
mov esi, eax
mov dword [ebp - 0x258], 0x3c
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.00424380
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x447a34
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x248], eax
mov eax, dword [0x45b014]
mov dword [ebp - 0x21c], eax
push esi
push 0x447a58
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0x447a60
push eax
call fcn.004100b0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004110b0
add esp, 0x14
mov dword [ebp - 0x23c], 0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x254], 0x400
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb edi, edi
mov eax, dword [ebp - 0x21c]
and edi, esi
lea ecx, [eax - 0xc]
cmp ecx, dword [0x45b010]
je 0x4114b1
add eax, 0xfffffff4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4114b1
push eax
call fcn.00420517
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret
Function at 0x4125c0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4452e6
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x45b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ec
push dword [edi + 4]
call esi
push 2
push 0xffffffffffffffff
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x24], eax
cmp eax, 0xffffffff
jne 0x412680
mov eax, dword [0x45b014]
mov dword [ebp - 0x424], eax
push 0x27e1
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], 0
call fcn.004120a0
mov esi, dword [ebp - 0x424]
push 0
push 0x45461c
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esi - 0xc]
cmp eax, dword [0x45b010]
je 0x4127bc
add esi, 0xfffffff4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4127bc
push esi
call fcn.00420517
add esp, 4
jmp 0x4127bc
push 0x3ff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3ff
push dword [edi + 4]
mov dword [edi + 0x30], eax
call esi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4127b0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00424380
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x447a98
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4126f6
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00424380
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00429a76
push str.KZMount.ini
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00429a01
mov eax, dword [0x45b014]
add esp, 0x24
mov dword [ebp - 0x424], eax
push 0x3ff
push dword [edi + 4]
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push eax
lea eax, [ebp - 0x424]
push 0x447b04
push eax
call fcn.004100b0
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x420]
add esp, 0xc
push eax
push esi
push str.DiskReadOnly
push 0x447af4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esi - 0xc]
cmp eax, dword [0x45b010]
je 0x4127b0
add esi, 0xfffffff4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4127b0
push esi
call fcn.00420517
add esp, 4
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204ef
mov esp, ebp
pop ebp
ret 0xc