joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409eb0
Capabilities:
Delete file

Disassembly:
sub esp, 0x218
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x20]
push 0x1032
push eax
call ebx
test eax, eax
je 0x40a0c6
mov ecx, dword [esi + 0x20]
push ebp
push edi
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
mov edx, dword [esi + 0x20]
push 2
mov edi, eax
push edi
push 0x100c
push edx
call ebx
mov eax, edi
imul eax, eax, 0x584
lea ebp, [eax + esi]
lea ecx, [ebp + 0x1d4bd]
mov eax, ecx
lea ebx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409f20
sub eax, ebx
jne 0x409f35
imul edi, edi, 0x1d4
lea ecx, [edi + esi + 0x70]
cmp byte [ebp + 0x1d5c2], 0
lea eax, [ebp + 0x1d5c2]
jne 0x409f6a
push ecx
lea ecx, [esp + 0x120]
push 0x105
push ecx
call fcn.004530e6
add esp, 0xc
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
jmp 0x409f80
push eax
lea eax, [esp + 0x120]
push 0x105
push eax
call fcn.004530e6
add esp, 0xc
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x18]
push str._sdxwnd.dxw
push edx
call fcn.00450b6c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call edi
push 0x47489c
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x474888
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x474880
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x474878
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x474870
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push str.dxwnd
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x474890
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push str.disasm
lea ecx, [esp + 0x120]
push ecx
push 0x474890
lea edx, [esp + 0x20]
push edx
call fcn.00450b6c
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0
push str.DxWnd_Proxy
push str.DxWnd_Proxies_uninstalled
mov ecx, esi
call fcn.0042ae63
pop edi
pop ebp
mov ecx, dword [esp + 0x21c]
pop esi
pop ebx
xor ecx, esp
call fcn.00450c28
add esp, 0x218
ret
Function at 0x40b320
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], 1
cmp dword [0x496540], edi
jne 0x40b3ec
mov eax, 0x4967c0
call fcn.004077d0
test eax, eax
je 0x40b361
mov dword [esp + 0xc], edi
push ebx
push ebp
lea ebx, [esi + 0x6c]
lea ebp, [esi + 0x1d46c]
lea esp, [esp]
cmp byte [ebx + 4], 0
je 0x40b3b4
cmp dword [ebp + 0x578], 0
jne 0x40b386
cmp dword [esp + 0x14], 0
je 0x40b39f
push edi
push ebx
mov esi, 0x4967c0
mov ecx, ebp
call fcn.0040a5c0
mov esi, dword [esp + 0x20]
add esp, 8
inc dword [esp + 0x10]
inc edi
add ebp, 0x584
add ebx, 0x1d4
cmp edi, 0x100
jl 0x40b370
push edi
mov edi, 0x4967c0
call fcn.00407a10
xor eax, eax
add esp, 4
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push eax
push str.SaveConfigFile:__d_updates_in__d_msec_n
call fcn.0041ab40
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x40b480
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x60], 0
je 0x40b4aa
push 0x24
push 0xea61
push 0xea7a
call fcn.0041a120
add esp, 0xc
cmp eax, 6
jne 0x40b4aa
mov ecx, esi
pop esi
jmp fcn.0040b320
pop esi
ret
Function at 0x40e590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46dc56
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x2ec], eax
push ebx
push esi
push edi
mov eax, dword [0x4946c0]
xor eax, esp
push eax
lea eax, [esp + 0x300]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x1f9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x200], 0
call fcn.00451440
add esp, 0xc
mov ebx, 1
push ebx
push 0
push esi
push 0
push 2
lea ecx, [esp + 0x208]
push ecx
push str..ini
push ebx
lea ecx, [esp + 0x34]
call fcn.0043c8f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x308], 0
call fcn.0043c056
lea ecx, [esp + 0x14]
mov dword [eax + 0xc], str.DxWnd_config__.ini_
call fcn.0043c056
lea ecx, [esp + 0x14]
mov dword [eax + 0x30], str.Open_DxWnd_config._file
call fcn.0043d0dc
cmp eax, ebx
jne 0x40e721
mov ecx, esi
call fcn.0040b480
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
call fcn.0043d208
mov edi, eax
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], ebx
mov byte [esp + 0x308], bl
jle 0x40e67e
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00401aa0
mov ecx, dword [edi]
mov edx, 0x4967c0
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x40e685
mov byte [esp + 0x308], al
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e6b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x75bbc]
call fcn.004369ef
lea ecx, [esi + 0x75bc4]
call fcn.004369ef
lea ecx, [esi + 0x75bcc]
call fcn.004369ef
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x1009
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.00409d90
mov edx, dword [esi]
mov eax, dword [edx + 0x164]
mov ecx, esi
call eax
mov ecx, esi
call fcn.00409d90
lea ecx, [esi + 0x6c]
push ecx
push 0
call sub.dxwnd.dll_Ordinal_1
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x308], 0xffffffff
call fcn.0043c73c
mov ecx, dword [esp + 0x300]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2ec]
xor ecx, esp
call fcn.00450c28
add esp, 0x2fc
ret
Function at 0x40ec70
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x46dd4b
mov eax, dword fs:[0]
push eax
mov eax, 0x1088
call fcn.00453f50
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x1084], eax
push ebx
push esi
push edi
mov eax, dword [0x4946c0]
xor eax, esp
push eax
lea eax, [esp + 0x1098]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
call fcn.004268e0
lea eax, [esp + 0x908]
push eax
mov dword [esp + 0x10a4], 0
call sub.dxwnd.dll_Ordinal_5
add esp, 4
or ebx, 0xffffffff
cmp eax, 2
je 0x40ecf7
push 0x30
push 0xea62
push 0xea71
call fcn.0041a120
add esp, 0xc
jmp 0x40edb6
push 0x62
call fcn.00428bea
movsx ecx, word [esp + 0x910]
imul ecx, ecx, 0x584
push ebx
lea edx, [ecx + edi + 0x1d46c]
push edx
mov esi, eax
push 0x30
push esi
push 0
call fcn.00453aa9
push esi
push 0x24
push 0xea61
push 0xea72
call fcn.0041a1d0
add esp, 0x28
cmp eax, 6
jne 0x40edc1
mov eax, dword [esp + 0x940]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40ed7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x940]
push eax
push ecx
push 0x30
push 0xea63
push 0xea73
call fcn.0041a1d0
add esp, 0x14
jmp 0x40edc1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40eda7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x30
push 0xea63
push 0xea74
call fcn.0041a1d0
add esp, 0x14
jmp 0x40edc1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
lea esi, [edi + 0x7586c]
call fcn.00407910
lea ecx, [esp + 0x10]
mov dword [esp + 0x10a0], ebx
call fcn.0040dfb0
mov ecx, dword [esp + 0x1098]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1084]
xor ecx, esp
call fcn.00450c28
add esp, 0x1094
ret

Function at 0x40ef10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46dcdb
mov eax, dword fs:[0]
push eax
sub esp, 0x8f8
push ebx
push esi
push edi
mov eax, dword [0x4946c0]
xor eax, esp
push eax
lea eax, [esp + 0x908]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
call fcn.004268e0
mov eax, dword [edi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1032
push eax
mov dword [esp + 0x920], 0
call ebx
test eax, eax
je 0x40efc6
mov ecx, dword [edi + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
mov edx, dword [edi + 0x20]
inc eax
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push edx
call ebx
imul esi, esi, 0x1d4
lea eax, [esi + edi + 0x6c]
mov dword [0x4966a8], eax
add eax, 4
push str.._pedump.txt
push eax
call fcn.0041b450
add esp, 8
push 1
push 0
push 0
push str..pedump.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x910], 0xffffffff
call fcn.0040dfb0
mov ecx, dword [esp + 0x908]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x904
ret
Function at 0x4116c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46de56
mov eax, dword fs:[0]
push eax
sub esp, 0xa04
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0xa00], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4946c0]
xor eax, esp
push eax
lea eax, [esp + 0xa18]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push ebx
lea ecx, [esp + 0x1c]
call fcn.004268e0
mov dword [esp + 0xa20], ebx
call fcn.0043149b
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41172a
push 0x80004005
call fcn.00401a00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov ecx, dword [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x1032
push ecx
mov byte [esp + 0xa30], 1
call edi
test eax, eax
jne 0x411775
lea eax, [esi - 0x10]
mov byte [esp + 0xa20], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41188c
mov ecx, dword [ebp + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call edi
mov edx, dword [ebp + 0x20]
inc eax
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push edx
call edi
imul esi, esi, 0x1d4
lea ecx, [esi + ebp + 0x70]
cmp ecx, ebx
jne 0x4117a8
xor eax, eax
jmp 0x4117b9
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4117b0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov esi, dword [esp + 0x14]
push 0x5c
push esi
call fcn.004537e1
add esp, 8
cmp eax, ebx
jne 0x41182c
or eax, 0xffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.0040f2f0
call fcn.00423230
test eax, eax
mov eax, str.open
jne 0x4117f7
mov eax, str.explore
mov edi, dword [esp + 0x14]
push 5
push ebx
push ebx
push edi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
jg 0x411875
cmp esi, 2
jne 0x411835
push edi
lea ecx, [esp + 0x914]
push str.folder___s__does_not_exist
push ecx
call fcn.00450b6c
add esp, 0xc
jmp 0x411860
sub eax, esi
jne 0x4117da
lea eax, [esi - 0x10]
jmp 0x411878
call fcn.00423230
test eax, eax
mov eax, str.open
jne 0x411848
mov eax, str.explore
push esi
push edi
push eax
lea edx, [esp + 0x91c]
push str.ShellExecute___s_____s___failed._nerror_d
push edx
call fcn.00450b6c
add esp, 0x14
push ebx
push str.error
lea eax, [esp + 0x918]
push eax
mov ecx, ebp
call fcn.0042ae63
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0xa20], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411898
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xa20], 0xffffffff
call fcn.0040dfb0
mov ecx, dword [esp + 0xa18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa00]
xor ecx, esp
call fcn.00450c28
add esp, 0xa10
ret
Function at 0x4118e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46dea6
mov eax, dword fs:[0]
push eax
sub esp, 0x8fc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4946c0]
xor eax, esp
push eax
lea eax, [esp + 0x910]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [esp + 0x1c]
call fcn.004268e0
mov dword [esp + 0x918], ebx
call fcn.0043149b
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41193c
push 0x80004005
call fcn.00401a00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov ecx, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x1032
push ecx
mov byte [esp + 0x928], 1
call ebp
test eax, eax
jne 0x411987
lea eax, [edi - 0x10]
mov byte [esp + 0x918], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x411a84
mov ecx, dword [esi + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebp
mov edx, dword [esi + 0x20]
inc eax
push 2
lea edi, [eax - 1]
push edi
push 0x100c
push edx
call ebp
mov eax, edi
imul eax, eax, 0x584
cmp byte [eax + esi + 0x1d5c2], bl
lea ecx, [eax + esi + 0x1d5c2]
je 0x4119f6
cmp ecx, ebx
jne 0x4119c8
xor eax, eax
jmp 0x4119d9
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4119d0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004041d0
push 0xa
push str.dxwnd.log
lea ecx, [esp + 0x1c]
call fcn.00404260
jmp 0x411a58
imul edi, edi, 0x1d4
lea edx, [edi + esi + 0x70]
cmp edx, ebx
jne 0x411a08
xor eax, eax
jmp 0x411a19
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411a10
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov esi, dword [esp + 0x14]
push 0x5c
push esi
call fcn.004537e1
add esp, 8
cmp eax, ebx
jne 0x411a3c
or eax, 0xffffffff
jmp 0x411a40
sub eax, esi
je 0x411a6d
push eax
lea ecx, [esp + 0x18]
call fcn.0040f2f0
push str.dxwnd.log
lea ecx, [esp + 0x18]
call fcn.00404360
mov esi, dword [esp + 0x14]
push 5
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x918], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411a90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x918], 0xffffffff
call fcn.0040dfb0
mov ecx, dword [esp + 0x910]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x908
ret
Function at 0x416920
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.extract.ico
call fcn.00454010
push str.extract.ico
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0041e2a0
push 0x4743b0
push str.extract.ico
call fcn.00452b32
push 2
mov esi, eax
push 0
push esi
call fcn.004531d8
push esi
call fcn.004536b7
mov edi, eax
push edi
call fcn.004525be
push 0
push 0
push esi
mov ebx, eax
call fcn.004531d8
push esi
push 1
push edi
push ebx
call fcn.004534fd
lea ecx, [edi + edi + 0x10]
add esp, 0x48
push ecx
call fcn.004525be
mov ebp, eax
push edi
push ebp
push ebx
call fcn.00416790
push ebx
call fcn.00453c5c
push esi
call fcn.004526ff
push str.extract.ico
call fcn.00454010
add esp, 0x1c
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x4169f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, ebp
push esi
lea edx, [eax + 1]
jmp 0x416a00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416a00
sub eax, edx
mov esi, eax
jne 0x416a14
pop esi
xor eax, eax
pop ebp
ret 4
push edi
push str.extract.ico
call fcn.00454010
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push str.extract.ico
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x416a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.extract.ico
push str.CreateFile_failure:_path_s_error_d_n
call fcn.0041ab40
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, 0x10
push ebx
push eax
call fcn.004525be
mov ebx, eax
push ebp
push ebx
call fcn.004167d0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416ab0
push str.icon_hex2char_error_n
call fcn.0041ab40
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.extract.ico
call fcn.00454010
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
cmp esi, dword [esp + 0x14]
je 0x416b04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_failure:_error_d_n
call fcn.0041ab40
add esp, 8
push edi
call ebx
push str.extract.ico
call fcn.00454010
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
push 0x50
push 0
push 0
push 1
push str.extract.ico
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
test esi, esi
jne 0x416b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.de_serialize_error__d_n
call fcn.0041ab40
add esp, 8
push str.extract.ico
call fcn.00454010
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x417d00
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x424]
lea eax, [esp + 8]
push eax
push ebx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x417d50
cmp dword [esp + 8], eax
jne 0x417d50
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00450c28
add esp, 0x41c
ret
cmp dword [0x4969d0], 0
push ebp
push esi
push edi
jne 0x417da5
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Psapi.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetMappedFileNameA
push esi
call ebp
mov dword [0x4969d0], eax
test eax, eax
jne 0x417da5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Kernel32.dll
call edi
push str.GetMappedFileNameA
push eax
call ebp
mov dword [0x4969d0], eax
test eax, eax
je 0x417eed
push 0
push 1
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x417ee8
push 1
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x417ee1
push 0x104
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4969d0]
test eax, eax
je 0x417eda
lea edx, [esp + 0x228]
push edx
push 0x1ff
mov byte [esp + 0x230], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x417eda
mov ax, word [0x476378]
mov cl, byte [0x47637a]
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
xor edi, edi
lea ebp, [esp + 0x228]
mov edi, edi
mov dl, byte [ebp]
push 0x104
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x417ec0
lea eax, [esp + 0x124]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417e70
sub eax, edx
mov esi, eax
cmp esi, 0x104
jae 0x417ec0
push esi
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00454a35
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
add edi, 1
je 0x417ec0
lea ecx, [esp + esi + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x476370
push 0x4968c8
call fcn.00450b6c
add esp, 0x10
mov al, byte [ebp]
inc ebp
test al, al
jne 0x417ec0
test edi, edi
jne 0x417ed6
cmp byte [ebp], 0
jne 0x417e40
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4968c8
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00450c28
add esp, 0x41c
ret
Function at 0x418940
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push str.Path
call edi
mov esi, eax
test esi, esi
jne 0x418967
push str.no_Path____n
call fcn.0041ab40
add esp, 4
call fcn.004187e0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418970
sub eax, edx
lea esi, [eax + esi + 2]
push esi
call fcn.004525be
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x418999
push str.no_memory____n
call fcn.0041ab40
add esp, 4
push esi
push ebx
push str.Path
call edi
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4189a5
mov ax, word [0x476800]
mov word [edi], ax
call fcn.004187e0
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4189c0
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4189d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push str.Path
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00453c5c
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x418a00
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebp
mov dword [0x4969d8], 0
call fcn.004187e0
push eax
push str._sproxy.dll
lea eax, [esp + 0x14c]
push 0x104
push eax
call fcn.00450be9
add esp, 0x10
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x418a85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FindFirstFile_failed___d__n
call fcn.0041ab40
add esp, 8
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00450c28
add esp, 0x248
ret
lea eax, [esp + 0x30]
push eax
push 0
push str.ProxyList__d__s_n
call fcn.0041ab40
lea eax, [esp + 0x3c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418aa0
push esi
sub eax, edx
inc eax
push edi
push eax
call fcn.004525be
add esp, 4
mov dword [0x4969d8], eax
lea ecx, [esp + 0x38]
mov edx, eax
mov esi, 1
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x418ac5
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0xc]
push ecx
push ebp
call edi
test eax, eax
je 0x418b36
cmp esi, 0x20
jge 0x418b36
lea edx, [esp + 0x38]
push edx
push esi
push str.ProxyList__d__s_n
call fcn.0041ab40
lea eax, [esp + 0x44]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418b00
sub eax, edx
push eax
call fcn.004525be
add esp, 4
mov dword [esi*4 + 0x4969d8], eax
lea ecx, [esp + 0x38]
mov edx, eax
inc esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x418b20
lea eax, [esp + 0xc]
push eax
push ebp
call edi
test eax, eax
jne 0x418ae1
push ebp
mov dword [esi*4 + 0x4969d8], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00450c28
add esp, 0x248
ret