joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c5c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x408], 1
test al, 1
je 0x41c5f3
mov ebx, 3
test al, 4
je 0x41c604
mov dword [ebp - 0x408], 0x21
or ebx, 4
mov ecx, dword [edi + 4]
push 0x100
lea eax, [ebp - 0x404]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [edi + 0x2c], 0
jne 0x41c676
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x41c676
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c633
mov ecx, dword [esi + 0x18]
sub eax, edx
lea edx, [esi + 0x1c]
push edx
mov edx, dword [edi + 0x28]
push 0
push 0x25
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push 1
push ecx
push edx
call dword [sym.imp.UxTheme.dll_DrawThemeText]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458db6
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
test byte [esi + 0x10], 4
mov dword [ebp - 0x40c], eax
je 0x41c693
mov eax, 0x828282
jmp 0x41c6a3
movzx eax, byte [edi + 0x2c]
neg eax
sbb eax, eax
and eax, 0xfefff8
add eax, 8
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esi + 0x18]
push 1
push edx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [edi + 4]
push 0x100
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c6e0
mov ecx, dword [esi + 0x18]
sub eax, edx
lea edx, [ebp - 0x414]
push edx
sar eax, 1
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c711
sub eax, edx
mov edx, dword [ebp - 0x408]
sar eax, 1
mov ecx, dword [esi + 0x24]
mov edi, eax
mov eax, dword [esi + 0x28]
push edx
push eax
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x410]
cdq
sub eax, edx
sar eax, 1
push ecx
sar ebx, 1
sub ebx, eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x414]
cdq
sub eax, edx
push ebx
sar eax, 1
sar ecx, 1
sub ecx, eax
mov eax, dword [esi + 0x18]
push ecx
push edi
lea edx, [ebp - 0x204]
push edx
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
mov ecx, dword [ebp - 0x40c]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458db6
mov esp, ebp
pop ebp
ret 4
Function at 0x41ccd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x400
mov edi, ecx
call fcn.00459337
add esp, 4
push 1
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 4]
push 0
push 0
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41cd1c
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [edi + 4]
push 0x200
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cd40
push 0
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
sar eax, 1
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push esi
call fcn.004592db
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458db6
mov esp, ebp
pop ebp
ret 4

Function at 0x41d9f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
test edi, edi
je 0x41da48
cmp byte [edi + 0x5c], 0x77
jne 0x41da48
cmp dword [edi + 0x10], 0
jne 0x41da35
mov ecx, dword [edi + 0x40]
mov eax, dword [edi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [edi + 0xc], eax
call fcn.0045a140
add esp, 0x10
cmp eax, 0x4000
je 0x41da2e
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x10], 0x4000
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.0041ea60
add esp, 8
pop edi
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop ebp
ret

Function at 0x41da50
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x41daa3
cmp dword [esi + 4], 0
jne 0x41daac
call fcn.0045b1ab
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.00459f57
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x41daa7
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.0045b3d3
add esp, 4
test eax, eax
je 0x41daa3
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x41e030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
push edi
test esi, esi
je 0x41e21b
cmp byte [esi + 0x5c], 0x72
jne 0x41e21b
mov eax, dword [esi + 0x38]
cmp eax, 0xfffffffd
je 0x41e211
cmp eax, 0xffffffff
je 0x41e211
cmp eax, 1
jne 0x41e073
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
test eax, eax
je 0x41e178
jmp 0x41e090
cmp dword [esi + 0x58], 0
jne 0x41e197
cmp dword [esi + 4], 0
jne 0x41e0ef
cmp dword [esi + 0x3c], 0
jne 0x41e0ef
call fcn.0045b1ab
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.00459f57
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x41e0ea
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.0045b3d3
add esp, 4
test eax, eax
jne 0x41e205
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, esi
call fcn.0041fb20
mov dword [esi + 0x38], eax
cmp eax, 1
jne 0x41e157
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x4c]
mov edx, edi
sub edx, ebx
mov ecx, ebx
call fcn.0041e780
mov dword [esi + 0x4c], eax
mov eax, esi
mov dword [ebp - 4], edi
call fcn.0041e740
cmp eax, dword [esi + 0x4c]
jne 0x41e16f
mov eax, esi
call fcn.0041e740
call fcn.0041dac0
cmp dword [esi + 0x38], 0
jne 0x41e176
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0x14]
mov eax, esi
call fcn.00419740
xor edx, edx
xor ecx, ecx
xor eax, eax
mov dword [esi + 8], edi
mov dword [esi + 0x14], ebx
call fcn.0041e780
mov ebx, dword [ebp - 4]
mov dword [esi + 0x4c], eax
cmp dword [esi + 0x38], 0
jne 0x41e178
cmp dword [esi + 0x3c], 0
jne 0x41e178
cmp dword [esi + 0x10], 0
jne 0x41e090
jmp 0x41e178
mov dword [esi + 0x38], 0xfffffffd
mov ebx, edi
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x4c]
sub edx, ebx
mov ecx, ebx
call fcn.0041e780
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 4]
mov eax, dword [esi + 0x10]
cmp edi, eax
jbe 0x41e1a3
mov edi, eax
test edi, edi
je 0x41e1ca
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push edi
push ecx
push edx
call fcn.0045d030
mov eax, dword [ebp + 8]
add dword [esi], edi
sub dword [esi + 0x10], edi
add eax, edi
add esp, 0xc
sub dword [esi + 4], edi
mov dword [ebp - 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41e1e7
mov ecx, dword [esi + 0x40]
mov edx, dword [ebp - 8]
push ecx
push eax
push 1
push edx
call fcn.00459f57
add esp, 0x10
sub dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x10]
add dword [esi + 8], eax
add dword [esi + 0x14], eax
test eax, eax
jne 0x41e220
mov dword [esi + 0x3c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x38], 0xffffffff
jmp 0x41e178
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
test edi, edi
je 0x41e46c
cmp byte [edi + 0x5c], 0x77
jne 0x41e46c
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [edi + 4], eax
test eax, eax
je 0x41e451
push ebx
lea ebx, [ebx]
cmp dword [edi + 0x10], 0
jne 0x41e28e
mov ecx, dword [edi + 0x40]
mov eax, dword [edi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [edi + 0xc], eax
call fcn.0045a140
add esp, 0x10
cmp eax, 0x4000
jne 0x41e449
mov dword [edi + 0x10], eax
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x41e432
cmp dword [edi + 0xc], 0
je 0x41e429
cmp dword [edi], 0
jne 0x41e2b2
cmp dword [edi + 4], 0
jne 0x41e429
mov eax, dword [esi + 4]
cmp eax, 0x29a
je 0x41e429
cmp dword [edi + 0x10], 0
jne 0x41e2d9
mov edx, dword [str.buffer_error]
mov dword [edi + 0x18], edx
mov eax, 0xfffffffb
jmp 0x41e437
mov ebx, dword [esi + 0x20]
mov dword [esi], edi
mov dword [esi + 0x20], 0
cmp eax, 0x2a
jne 0x41e35d
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x7c]
sub ecx, 8
dec eax
shl ecx, 0xc
sar eax, 1
add ecx, 0x800
cmp eax, 3
jbe 0x41e309
mov eax, 3
shl eax, 6
or ecx, eax
cmp dword [esi + 0x64], 0
je 0x41e317
or ecx, 0x20
mov eax, 0x8421085
mul ecx
sub ecx, edx
shr ecx, 1
lea eax, [edx + ecx]
shr eax, 4
inc eax
mov ecx, eax
shl ecx, 5
sub ecx, eax
mov eax, esi
mov dword [esi + 4], 0x71
call fcn.0041ece0
cmp dword [esi + 0x64], 0
je 0x41e356
movzx ecx, word [edi + 0x32]
call fcn.0041ece0
movzx ecx, word [edi + 0x30]
call fcn.0041ece0
mov dword [edi + 0x30], 1
cmp dword [esi + 0x14], 0
je 0x41e37e
mov eax, edi
call fcn.0041ed10
cmp dword [edi + 0x10], 0
jne 0x41e39a
mov dword [esi + 0x20], 0xffffffff
xor eax, eax
jmp 0x41e437
cmp dword [edi + 4], 0
jne 0x41e39a
test ebx, ebx
js 0x41e39a
mov eax, dword [str.buffer_error]
mov dword [edi + 0x18], eax
mov eax, 0xfffffffb
jmp 0x41e437
cmp dword [esi + 4], 0x29a
jne 0x41e3b9
cmp dword [edi + 4], 0
je 0x41e3bf
mov ecx, dword [str.buffer_error]
mov dword [edi + 0x18], ecx
mov eax, 0xfffffffb
jmp 0x41e437
cmp dword [edi + 4], 0
jne 0x41e3c5
cmp dword [esi + 0x6c], 0
je 0x41e377
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*2]
mov eax, dword [edx*4 + 0x481a50]
push 0
push esi
call eax
add esp, 8
cmp eax, 2
je 0x41e3e4
cmp eax, 3
jne 0x41e3eb
mov dword [esi + 4], 0x29a
test eax, eax
je 0x41e414
cmp eax, 2
je 0x41e414
cmp eax, 1
jne 0x41e377
push 0
push 0
xor ecx, ecx
mov eax, esi
call fcn.00420ec0
add esp, 8
mov eax, edi
call fcn.0041ed10
cmp dword [edi + 0x10], 0
jne 0x41e377
mov dword [esi + 0x20], 0xffffffff
xor eax, eax
jmp 0x41e437
mov ecx, dword [str.stream_error]
mov dword [edi + 0x18], ecx
mov eax, 0xfffffffe
mov dword [edi + 0x38], eax
test eax, eax
jne 0x41e450
cmp dword [edi + 4], eax
jne 0x41e260
jmp 0x41e450
mov dword [edi + 0x38], 0xffffffff
pop ebx
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x4c]
mov edx, esi
call fcn.0041e780
mov dword [edi + 0x4c], eax
mov eax, esi
sub eax, dword [edi + 4]
pop esi
pop ebp
ret
mov eax, 0xfffffffe
pop ebp
ret
Function at 0x41e780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x41e787
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x41e85d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x481ac0]
add ecx, 8
sub edx, 8
dec esi
jne 0x41e7a0
pop edi
test edx, edx
je 0x41e87a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x481ac0]
inc ecx
dec edx
jne 0x41e861
not eax
pop esi
ret
Function at 0x41f010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 8], edi
jmp 0x41f023
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x64]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x6c]
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 4], ebx
jne 0x41f042
test eax, eax
jne 0x41f050
test ecx, ecx
jne 0x41f050
mov dword [ebp - 4], edi
jmp 0x41f0bc
cmp ebx, 0xffffffff
jne 0x41f050
mov dword [ebp - 4], 0xfffffffe
jmp 0x41f0bc
mov ecx, dword [esi + 0x24]
lea edx, [edi + ecx - 0x106]
cmp eax, edx
jb 0x41f0bc
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0045d030
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41f090
sub eax, edi
jmp 0x41f092
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41f081
mov ecx, dword [esi + 0x38]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41f0af
sub eax, edi
jmp 0x41f0b1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41f0a0
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x41f158
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [ebp - 4]
mov ebx, ecx
mov dword [ebp - 0xc], eax
cmp ebx, edx
jbe 0x41f0e2
mov ebx, edx
test ebx, ebx
je 0x41f11c
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x18], 0
jne 0x41f10a
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.004219a0
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [edi]
push ebx
push edx
push eax
call fcn.0045d030
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x6c], ebx
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x41f144
mov edx, dword [esi + 0x64]
add edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
movzx edx, byte [edx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x41f158
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x41f020
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4219a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x4219bc
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x421ac7
jmp 0x4219d0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x4219df
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jl 0x421a8c
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x421a00
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
dec edx
jne 0x421a00
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x421a9b
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x421a90
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x4219d0
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret

Function at 0x4232c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x423230
push 0
push 0
mov byte [esi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423310
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov byte [esi + 0xe], 1
test eax, eax
je 0x423347
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 8]
mov dword [esi + 0x10], 0
test ecx, ecx
je 0x423347
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
pop esi
jmp eax
pop esi
ret
Function at 0x423670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4776e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, esi
call fcn.0040263b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4236b0
test al, 0x10
je 0x423706
push 0x485670
push 0x485678
call fcn.004087e0
add esp, 8
push eax
lea eax, [ebp - 0x2c]
call fcn.004025d0
push 0
push esi
or eax, 0xffffffff
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00403074
push 0x485bf4
mov eax, edi
push 0
push eax
lea edi, [ebx + 0x8d20]
or eax, 0xffffffff
call fcn.00403074
push eax
call fcn.0040260f
lea ecx, [ebp - 0x2c]
call fcn.00402601
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458db6
mov esp, ebp
pop ebp
ret

Function at 0x423720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4776e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, esi
call fcn.0040263b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423760
test al, 0x10
jne 0x4237b6
push 0x485670
push 0x483f10
call fcn.004087e0
add esp, 8
push eax
lea eax, [ebp - 0x2c]
call fcn.004025d0
push 0
push esi
or eax, 0xffffffff
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00403074
push 0x485bf4
mov eax, edi
push 0
push eax
lea edi, [ebx + 0x8d20]
or eax, 0xffffffff
call fcn.00403074
push eax
call fcn.0040260f
lea ecx, [ebp - 0x2c]
call fcn.00402601
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458db6
mov esp, ebp
pop ebp
ret

Function at 0x423bd0
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push str.wnloader_web_setup_mutex
push 0x483f10
call fcn.004087e0
add esp, 8
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete al
pop ecx
ret
Function at 0x423c00
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4776e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
call edx
lea ebx, [edi + 0xa14]
mov esi, eax
mov dword [ebp - 4], 0
call fcn.0040388e
lea ecx, [ebp - 0x2c]
call fcn.00402601
mov eax, ebx
call fcn.0040263b
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x423c7e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423c7e
test al, 0x10
jne 0x423c7e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458db6
mov esp, ebp
pop ebp
ret

Function at 0x4240d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x49b3d4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
xor ecx, ecx
push ecx
push 0x483ec4
push 0x484350
mov word [esi + 0x80c], cx
lea edi, [esi + 0x604]
call fcn.004087e0
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0xc
push eax
push 0x104
push edi
call ebx
mov eax, edi
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424125
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 0x602], 0x5c
jne 0x42415d
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424144
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esi + eax*2 + 0x602], dx
add esi, 0xaec
push esi
push edi
push 0x485754
push 0x484350
call fcn.004087e0
add esp, 8
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call ebx
add esp, 0x14
push esi
push ecx
push str.oftware_s
push 0x4841d0
call fcn.004087e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x41c]
push 0x104
push ecx
call ebx
add esp, 0x10
push 0
lea edx, [ebp - 0x420]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x424222
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4241e4
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x420]
push ecx
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push str.exec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458db6
mov esp, ebp
pop ebp
ret 4