joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x414ae3
cmp word [esi], ax
je 0x414ae3
mov eax, dword [esp + 0xc]
mov ecx, dword [0x41d88c]
push edi
push eax
push ecx
call fcn.00415a13
mov edi, eax
test edi, edi
je 0x414ade
mov eax, dword [esp + 0x18]
cmp eax, 0x19
jne 0x414a7e
cmp dword [edi + 4], 0
mov eax, esi
lea edx, [eax + 2]
je 0x414a50
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414a30
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push esi
push edi
call fcn.00414760
pop edi
pop esi
pop ecx
ret 0xc
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414a50
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [edi]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor ecx, ecx
cmp eax, 2
setne cl
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [ecx - 1]
and eax, 0xfde9
push eax
call fcn.00414980
mov esi, eax
test esi, esi
je 0x414ade
cmp dword [edi + 4], 0
je 0x414ab8
mov eax, dword [esp + 0x14]
push eax
push esi
push edi
call fcn.00414760
mov dword [esp + 8], eax
jmp 0x414ace
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x41d3f4]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x414af0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x41d3f4]
sub esp, 0xc
push esi
push edi
push 0x1000
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x414c85
mov ax, word [esp + 8]
push ebx
push ebp
mov ebx, edi
mov ebp, 0x1000
mov dword [esp + 0x18], 0x7ff
lea esp, [esp]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xffffffff
je 0x414b46
test ecx, ecx
je 0x414bf0
dec ecx
mov dword [esp + 0x28], ecx
mov esi, dword [esp + 0x20]
cmp dword [esi + 4], 0
je 0x414b63
push 2
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00414860
mov dword [esp + 0x14], eax
jmp 0x414b7a
mov ecx, dword [esi]
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 2
mov ax, word [esp + 0x10]
jne 0x414bf4
test ax, ax
je 0x414b96
mov word [ebx], ax
mov ax, word [esp + 0x10]
add ebx, 2
mov esi, ebx
sub esi, edi
sar esi, 1
cmp esi, dword [esp + 0x18]
jle 0x414bcb
mov edx, dword [0x41d3f4]
add dword [esp + 0x18], 0x800
add ebp, 0x1000
push ebp
push edi
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov ax, word [esp + 0x10]
lea ebx, [edi + esi*2]
test ax, ax
je 0x414bf0
cmp dword [esp + 0x24], 0
jne 0x414b30
cmp ax, 0xd
je 0x414bfd
cmp ax, 0xa
jne 0x414b30
sub ebx, 2
jmp 0x414c68
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x24], 0
jne 0x414c68
jmp 0x414c01
mov esi, dword [esp + 0x20]
cmp ax, 0xa
jne 0x414c0c
sub ebx, 2
jmp 0x414c68
cmp ax, 0xd
jne 0x414c68
sub ebx, 2
cmp dword [esi + 4], 0
je 0x414c2e
push 2
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00414860
mov dword [esp + 0x14], eax
jmp 0x414c45
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x414c68
cmp dword [esi + 4], 0
je 0x414c59
add dword [esi + 0xc], 2
jmp 0x414c68
mov ecx, dword [esi]
push 1
push 0
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
mov edx, ebx
sub edx, edi
sar edx, 1
pop ebp
mov dword [eax], edx
xor ecx, ecx
mov word [ebx], cx
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 0x10
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 0x10
Function at 0x414c90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x41d3f4]
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x1000
push ebx
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x414df1
mov al, byte [esp + 0xf]
push ebp
mov ebp, edi
lea esp, [esp]
mov ecx, dword [esp + 0x24]
cmp ecx, 0xffffffff
je 0x414cd6
test ecx, ecx
je 0x414d69
dec ecx
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x1c]
cmp dword [esi + 4], 0
je 0x414cf3
push 1
lea ecx, [esp + 0x17]
push ecx
push esi
call fcn.00414860
mov dword [esp + 0x14], eax
jmp 0x414d0a
mov ecx, dword [esi]
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x1f]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 1
mov al, byte [esp + 0x13]
jne 0x414d6d
test al, al
je 0x414d21
mov byte [ebp], al
mov al, byte [esp + 0x13]
inc ebp
mov esi, ebp
sub esi, edi
lea edx, [ebx - 1]
cmp esi, edx
jle 0x414d4b
mov eax, dword [0x41d3f4]
add ebx, 0x1000
push ebx
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x414d69
cmp dword [esp + 0x20], 0
jne 0x414cc0
cmp al, 0xd
je 0x414d76
cmp al, 0xa
jne 0x414cc0
dec ebp
jmp 0x414dd7
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x20], 0
jne 0x414dd7
jmp 0x414d7a
mov esi, dword [esp + 0x1c]
cmp al, 0xa
jne 0x414d81
dec ebp
jmp 0x414dd7
cmp al, 0xd
jne 0x414dd7
dec ebp
cmp dword [esi + 4], 0
je 0x414d9f
push 1
lea ecx, [esp + 0x17]
push ecx
push esi
call fcn.00414860
mov dword [esp + 0x14], eax
jmp 0x414db6
mov ecx, dword [esi]
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x1f]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x414dd7
cmp dword [esi + 4], 0
je 0x414dc8
inc dword [esi + 0xc]
jmp 0x414dd7
mov edx, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x28]
mov eax, ebp
sub eax, edi
mov dword [ecx], eax
mov byte [ebp], 0
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 0x10

Function at 0x4155d4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x415646
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
cmp ebx, ebp
jne 0x4155f2
mov ebx, section..rdata
push ebx
call sub.MSVCRT.dll_wcslen
pop ecx
lea edi, [eax + eax + 2]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x41563d
call dword [sym.imp.USER32.DLL_EmptyClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41563d
push edi
push ebx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.DLL_SetClipboardData]
mov ebp, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
ret 4
Function at 0x41564c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
xor esi, esi
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x41568d
push 0xd
call dword [sym.imp.USER32.DLL_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x415685
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x415685
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
mov edi, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
jmp 0x415690
mov ebx, dword [ebp + 8]
push dword [ebp + 8]
push edi
call fcn.00416280
test esi, esi
je 0x4156b5
lea ecx, [edi + edi + 2]
push ecx
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4156ba
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x446d449d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x35685c1a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x726b3fcd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x67b445a3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x401222
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov cl, byte [0x404050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x404054
add edx, dword [0x404050]
call fcn.00401163
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4032ed
push eax
sub edi, fcn.00402a87
push edi
push fcn.00402a87
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401299
mov eax, fcn.00402a87
mov ebx, esi
mov edx, edi
call fcn.00401163
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00401932
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.00402461
lea eax, [esi + 0x1c000]
lea edi, [esi + 1]
imul edi, eax
mov ebx, 0x404054
or bl, 1
xor edx, edx
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.00402a87
lea esp, [ebp + 0x82]
pop ebp

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5d6e70be
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21675609
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx + 0x14]
push edi
mov edi, ecx
mov esi, dword [edi + 0xbc]
mov ecx, dword [edi + 0x1c]
add esi, edi
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xc], eax
mov eax, 0x100
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x4018ae
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x78]
test al, 4
je 0x4018c2
test byte [ecx + 0x3a], 1
je 0x4018e2
and eax, 0xfffffffb
mov dword [edi + 0x78], eax
or dword [esi + 0x10], 0x200
test byte [ecx + 0x3a], 2
je 0x4018e2
mov eax, dword [ecx + 0x46]
or dword [esi + 0x10], 0x400
mov dword [esi + 0x14], eax
test dword [edi + 0x78], 0x400
je 0x4018f2
or dword [esi + 0x10], 0x4000
test byte [ecx + 0x3a], 4
je 0x4018ff
or dword [esi + 0x10], 0x100
test byte [ebx + 6], 2
mov edx, 1
je 0x401927
or dword [esi + 0x10], 0x80
mov word [esi + 0x20], dx
cmp word [edi + 0x18], 3
jne 0x40192c
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x40192c
or word [esi + 0x20], 0x20
mov eax, dword [ecx + 0x3c]
mov dword [esi + 0x18], eax
cmp word [esi + 0x18], 0xd
mov eax, dword [ecx + 0x40]
mov dword [esi + 0x1c], eax
jne 0x401993
movsx edx, word [ecx]
mov ecx, dword [0x4b39cc]
cmp edx, dword [ecx + 0x194]
jge 0x401989
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
mov eax, dword [0x4b39cc]
mov ecx, dword [eax + 0x1a0]
mov eax, dword [eax + 0x19c]
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x401989
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x401989
mov edx, dword [edx + 0xc]
call fcn.00434ea0
jmp 0x40198b
xor eax, eax
mov dword [esi + 0x1c], eax
mov edx, 1
cmp dword [edi + 0xcc], 0
jne 0x4019a5
or word [esi + 0x20], 2
or dword [esi + 0x10], 8
mov cx, word [esi + 0x10]
pop edi
mov word [esi + 0x22], cx
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x403210
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov word [esi], ax
test edx, edx
je 0x40329e
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push eax
push eax
movzx ebx, dx
push 0x59
push ebx
call edi
cmp eax, 0x63
jge 0x40329c
push eax
push esi
push 0x59
push ebx
call edi
lea edi, [esi - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x403241
mov eax, dword [0x491d68]
mov dword [edi], eax
mov edi, esi
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403260
push 0
push 0
push 0x5a
sub edi, ecx
push ebx
sar edi, 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, 0x63
sub ecx, edi
cmp eax, ecx
jge 0x403297
push eax
lea eax, [esi + edi*2]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x40329c
xor eax, eax
mov word [esi], ax
pop edi
pop ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4032a1
sub esi, ecx
sar esi, 1
mov eax, esi
pop esi
ret
Function at 0x404940
Capabilities:
Check os version
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a960
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404a03
cmp dword [ebp - 0x118], 2
jne 0x404a03
mov eax, dword [ebp - 0x124]
cmp eax, 6
ja 0x4049ab
jne 0x404a03
cmp dword [ebp - 0x120], 1
jbe 0x404a03
push 0x491d6c
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x404a03
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmDisableIME
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4049fc
push str.ImmIsIME
push esi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4049f8
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
test eax, eax
je 0x4049f8
push eax
call ebx
test eax, eax
je 0x4049fc
push 0xffffffffffffffff
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046d526
mov esp, ebp
pop ebp
ret
Function at 0x4076d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea edx, [ecx + 2]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4076e0
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 4]
push eax
call fcn.0046dd84
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4077a0
mov ecx, ebx
sub ecx, esi
mov edi, edi
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x407710
push 0x5c
push ebx
call fcn.0046f61f
add esp, 8
test eax, eax
je 0x407734
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x40775d
cmp word [ebx + 2], 0x5c
jne 0x40775d
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.0046f6c5
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x407780
push 0x5c
lea eax, [ebx + 2]
push eax
jmp 0x407776
cmp word [ebx + 2], 0x3a
jne 0x407773
cmp word [ebx + 4], 0x5c
jne 0x407773
push 0x5c
lea eax, [ebx + 6]
push eax
jmp 0x407776
push 0x5c
push ebx
call fcn.0046f6c5
add esp, 8
mov ebx, eax
push 2
push 0x104
call fcn.0046dd84
mov esi, eax
add esp, 8
test esi, esi
jne 0x4077aa
push dword [ebp - 4]
call fcn.0046d5c7
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ebx, ebx
je 0x407817
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push esi
call fcn.0046f773
push esi
call fcn.0046f7b6
add esp, 0x10
test eax, eax
je 0x4077f3
push esi
call fcn.0046f8d3
add esp, 4
test eax, eax
je 0x4077e0
mov edi, 1
jmp 0x4077f3
push esi
call fcn.0046f7b6
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
lea eax, [ebx + 2]
push 0x5c
push eax
mov dword [ebp - 8], ebx
call fcn.0046f6c5
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40788b
mov ecx, dword [ebp - 8]
test edi, edi
je 0x4077b1
jmp 0x40788b
mov edx, esi
sub edx, dword [ebp - 4]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x407820
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407834
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x407857
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x407857
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push esi
call fcn.0046f7b6
add esp, 4
test eax, eax
je 0x40788b
push esi
call fcn.0046f8d3
add esp, 4
test eax, eax
je 0x407878
mov edi, 1
jmp 0x40788b
push esi
call fcn.0046f7b6
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
push esi
call fcn.0046d5c7
push dword [ebp - 4]
call fcn.0046d5c7
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4078b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4078df
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x26
neg eax
sbb eax, eax
add eax, 0x40000002
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jne 0x4078f0
mov eax, 0x40000001
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp ecx, dword [ebp + 8]
mov edx, 0x40000002
cmovne eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x407910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407942
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x70
neg eax
sbb eax, eax
add eax, 0x40000004
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp - 4], esi
mov ecx, 0x40000004
cmovne eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4079a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
push 1
push 0x8000
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ecx
xor esi, esi
call fcn.0046dd84
add esp, 8
mov dword [ebp - 4], eax
test edi, edi
je 0x407a63
lea ecx, [ecx]
push 0
mov ebx, 0x8000
cmp edi, ebx
cmovb ebx, edi
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407a5b
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x407a65
cmp eax, ebx
jne 0x407a65
mov ecx, ebx
shr ecx, 2
mov edx, edi
test ecx, ecx
je 0x407a21
lea esp, [esp]
mov eax, esi
shr eax, 0x1f
add edx, 4
lea esi, [eax + esi*2]
add esi, dword [edx - 4]
dec ecx
jne 0x407a10
mov eax, ebx
and eax, 3
mov dword [ebp - 0x14], eax
mov edi, 0
jbe 0x407a48
mov ebx, eax
movzx ecx, byte [edi + edx]
mov eax, esi
shr eax, 0x1f
add ecx, eax
inc edi
lea esi, [ecx + esi*2]
cmp edi, ebx
jb 0x407a32
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 8]
sub edi, ebx
mov dword [ebp - 8], edi
jne 0x4079d0
mov edi, dword [ebp - 4]
jmp 0x407a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407a65
mov edi, eax
push 0x8000
push 0
push edi
call fcn.00472310
push edi
call fcn.0046d5c7
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 0
push 0
mov ebx, ecx
push 0x186a0
push ebx
mov dword [ebp - 8], 0
call esi
push 1
push 0
push 0
push ebx
call esi
push 2
push 0
push 0
push ebx
mov edi, eax
call esi
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov esi, eax
call edi
cmp esi, 0x155cc0
jge 0x407b04
push 1
push 0
push 0
push ebx
call edi
push 2
push 0
push 0
push ebx
mov esi, eax
call edi
push 0
push 0
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x407b09
mov edi, 0x155cc0
lea eax, [edi + 8]
push 1
push eax
call fcn.0046dd84
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x407b95
push 0
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407b39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
je 0x407b82
cmp dword [esi], 0x77777777
jne 0x407b54
cmp dword [ecx + eax + 4], 0x12478749
je 0x407b6d
inc eax
inc esi
cmp eax, edi
jb 0x407b42
push ecx
call fcn.0046d5c7
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, ecx
add esi, 0x186a0
mov dword [0x4b3884], esi
mov dword [ebp - 8], 1
push ecx
call fcn.0046d5c7
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret