joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a631
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004128df
xor ebx, ebx
cmp dword [0x447184], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41a707
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41a7e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41a7e7
push eax
call fcn.00412871
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x447184], eax
call esi
push eax
call fcn.00412871
mov dword [esp], 0x436f94
push edi
mov dword [0x447188], eax
call esi
push eax
call fcn.00412871
mov dword [0x44718c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040ef72
test eax, eax
pop ecx
pop ecx
je 0x41a6d5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e478
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41a707
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00412871
cmp eax, ebx
pop ecx
mov dword [0x447194], eax
je 0x41a707
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412871
pop ecx
mov dword [0x447190], eax
mov eax, dword [0x447190]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41a78c
cmp dword [0x447194], ecx
je 0x41a78c
push eax
call fcn.004128e8
push dword [0x447194]
mov esi, eax
call fcn.004128e8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41a78c
cmp edi, ebx
je 0x41a78c
call esi
cmp eax, ebx
je 0x41a759
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a759
test byte [ebp - 0x18], 1
jne 0x41a78c
lea eax, [ebp - 0x10]
push eax
call fcn.0040efa9
test eax, eax
pop ecx
je 0x41a774
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e478
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41a783
or dword [ebp + 0x10], 0x200000
jmp 0x41a7c7
or dword [ebp + 0x10], 0x40000
jmp 0x41a7c7
mov eax, dword [0x447188]
cmp eax, dword [ebp - 8]
je 0x41a7c7
push eax
call fcn.004128e8
cmp eax, ebx
pop ecx
je 0x41a7c7
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41a7c7
mov eax, dword [0x44718c]
cmp eax, dword [ebp - 8]
je 0x41a7c7
push eax
call fcn.004128e8
cmp eax, ebx
pop ecx
je 0x41a7c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x447184]
call fcn.004128e8
cmp eax, ebx
pop ecx
je 0x41a7e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a7e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427a90
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x433b98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x2e
lea ecx, [esp + 0x24]
call fcn.00427930
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x38]
push 1
push 0x2e
push eax
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.0042cb80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
movzx edx, word [eax + 4]
mov word [esi + 8], dx
movzx ecx, word [eax + 6]
mov word [esi + 0xa], cx
movzx edx, word [eax + 8]
lea edi, [esi + 4]
mov word [esi + 0xc], dx
movzx ecx, word [eax + 0xa]
mov word [esi + 0xe], cx
movzx edx, word [eax + 0xc]
mov word [esi + 0x10], dx
movzx ecx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
movzx ecx, word [eax + 0x1c]
movzx edx, word [eax + 0x1e]
mov dword [esp + 0x38], ecx
movzx ecx, word [eax + 0x20]
mov dword [esp + 0x14], edx
movzx edx, word [eax + 0x22]
mov word [esi + 0x20], dx
mov dword [esp + 0x18], ecx
movzx ecx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x1c]
mov dword [esi + 0x28], eax
call fcn.00427810
mov eax, 4
mov ecx, 0x4441bc
mov edx, edi
lea esp, [esp]
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x427b98
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x427b80
test eax, eax
je 0x427bf5
movzx ebp, byte [ecx]
movzx edi, byte [edx]
sub edi, ebp
jne 0x427be7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x427bf5
movzx ebp, byte [ecx]
movzx edi, byte [edx]
sub edi, ebp
jne 0x427be7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x427bf5
movzx ebp, byte [ecx]
movzx edi, byte [edx]
sub edi, ebp
jne 0x427be7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x427bf5
movzx ecx, byte [ecx]
movzx edi, byte [edx]
sub edi, ecx
je 0x427bf5
test edi, edi
mov eax, 1
jg 0x427bf7
or eax, 0xffffffff
jmp 0x427bf7
xor eax, eax
test eax, eax
je 0x427c13
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00427960
xor al, al
jmp 0x427c97
movzx edi, word [esp + 0x38]
mov ebp, dword [ebx + 0x50]
push 0
push edi
lea ecx, [esi + 0x38]
call fcn.00427840
mov eax, dword [esi + 0x3c]
push 1
push edi
push eax
mov ecx, ebx
call fcn.0042cb80
mov eax, dword [esp + 0x14]
test ax, ax
je 0x427c59
movzx edi, ax
push 0
push edi
lea ecx, [esi + 0x2c]
call fcn.00427840
mov eax, dword [esi + 0x30]
push 1
push edi
push eax
mov ecx, ebx
call fcn.0042cb80
mov eax, dword [esp + 0x18]
test ax, ax
je 0x427c7e
movzx edi, ax
push 0
push edi
lea ecx, [esi + 0x44]
call fcn.00427840
mov esi, dword [esi + 0x48]
push 1
push edi
push esi
mov ecx, ebx
call fcn.0042cb80
cmp dword [ebx + 0x50], ebp
lea ecx, [esp + 0x1c]
sete bl
mov dword [esp + 0x30], 0xffffffff
call fcn.00427960
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x427d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x433bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x4c]
mov ebp, dword [esi + 0x40]
mov edi, dword [esi + 0x34]
mov dword [esp + 0x18], eax
movzx eax, ax
movzx ecx, di
movzx ebx, bp
mov dword [esp + 0x1c], eax
add eax, ebx
lea eax, [eax + ecx + 0x2e]
push 0
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.00427930
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0x28]
mov word [ecx + 4], ax
movzx edx, word [esi + 0xa]
mov eax, dword [esp + 0x28]
mov word [eax + 6], dx
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 0x28]
mov word [edx + 8], cx
movzx eax, word [esi + 0xe]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0xa], ax
movzx edx, word [esi + 0x10]
mov eax, dword [esp + 0x28]
mov word [eax + 0xc], dx
movzx ecx, word [esi + 0x12]
mov edx, dword [esp + 0x28]
mov word [edx + 0xe], cx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x28]
mov dword [eax + 0x14], edx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x18], ecx
mov eax, dword [esp + 0x28]
mov word [eax + 0x1c], bp
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov word [ecx + 0x1e], di
mov edx, dword [esp + 0x28]
mov word [edx + 0x20], bp
movzx eax, word [esi + 0x20]
mov ecx, dword [esp + 0x28]
mov word [ecx + 0x22], ax
movzx edx, word [esi + 0x22]
mov eax, dword [esp + 0x28]
mov word [eax + 0x24], dx
mov ecx, dword [esi + 0x24]
mov edx, dword [esp + 0x28]
mov dword [edx + 0x26], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x2a], eax
mov eax, dword [esi + 0x3c]
mov edx, dword [esp + 0x28]
push ebx
push eax
add edx, 0x2e
push edx
mov dword [esp + 0x44], 0
call fcn.0040e040
add esp, 0xc
test di, di
je 0x427e70
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x30]
mov edx, dword [esp + 0x28]
push ecx
push eax
lea eax, [ebx + edx + 0x2e]
push eax
call fcn.0040e040
add esp, 0xc
test bp, bp
je 0x427e95
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov esi, dword [esi + 0x48]
mov eax, dword [esp + 0x28]
push ecx
add ebx, edx
lea ecx, [ebx + eax + 0x2e]
push esi
push ecx
call fcn.0040e040
add esp, 0xc
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
push 1
push esi
push edx
call fcn.0042c490
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.00427960
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x428130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x433b98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x34]
mov ebp, dword [esi + 0x40]
mov dword [esp + 0x14], eax
movzx eax, ax
movzx edi, bp
lea ebx, [edi + eax + 0x1e]
push 0
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
call fcn.00427930
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4441c0]
mov dword [eax], ecx
movzx edx, word [esi + 0xa]
mov eax, dword [esp + 0x20]
mov word [eax + 4], dx
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 0x20]
mov word [edx + 6], cx
mov ax, word [esi + 0xe]
mov ecx, dword [esp + 0x20]
mov word [ecx + 8], ax
movzx edx, word [esi + 0x10]
mov eax, dword [esp + 0x20]
mov word [eax + 0xa], dx
movzx ecx, word [esi + 0x12]
mov edx, dword [esp + 0x20]
mov word [edx + 0xc], cx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x20]
mov dword [ecx + 0xe], eax
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x20]
mov dword [eax + 0x12], edx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [edx + 0x16], ecx
mov eax, dword [esp + 0x20]
movzx edx, word [esp + 0x14]
mov word [eax + 0x1a], bp
mov ecx, dword [esp + 0x20]
mov word [ecx + 0x1c], dx
mov eax, dword [esi + 0x3c]
push edi
push eax
mov eax, dword [esp + 0x28]
add eax, 0x1e
push eax
mov dword [esp + 0x3c], 0
call fcn.0040e040
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push eax
lea eax, [edi + edx + 0x1e]
push eax
call fcn.0040e040
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x50]
add esp, 0x18
push 1
push ebx
push ecx
mov ecx, edi
call fcn.0042c490
lea ecx, [esi + 0x2c]
call fcn.00427810
mov eax, dword [edi + 0x50]
mov word [esi + 0x20], ax
mov ecx, dword [edi + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x30]
sub ecx, ebx
add eax, ecx
mov dword [esi + 0x28], eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00427960
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x428780
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x428791
xor al, al
pop esi
ret 4
push 0x438d7c
push 0
push 0
push 4
push 0
call fcn.00427490
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi], eax
je 0x42878b
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
test eax, eax
mov dword [esi + 4], eax
setne cl
mov al, cl
pop esi
ret 4
Function at 0x42ae20
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x42ae45
xor al, al
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x42ae62
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
pop edi
mov al, 1
pop esi
ret

Function at 0x42ae70
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x42ae90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42aea3
xor al, al
ret
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov al, 1
ret

Function at 0x42afe0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42b002
cmp byte [esp + 0xc], al
je 0x42affe
push esi
push 0x71
call fcn.00422800
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x42b160
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x433f18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call fcn.00423940
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.0042b130
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov eax, dword [esp + 8]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b1d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042cc50
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x28
ret
Function at 0x42b2a0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x433f50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423940
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], ebx
call fcn.0042b130
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
mov byte [esp + 0x5c], 1
call esi
test eax, eax
jne 0x42b390
push 0x438300
lea ecx, [esp + 0x14]
call fcn.00424630
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004043c6
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
push edi
call esi
test eax, eax
jne 0x42b390
lea eax, [edi - 0x10]
mov byte [esp + 0x48], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b36a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
call fcn.0042cc50
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
mov esi, dword [esp + 0x18]
imul esi, dword [esp + 0x1c]
imul esi, dword [esp + 0x20]
lea eax, [edi - 0x10]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x48], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b3c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
call fcn.0042cc50
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret

Function at 0x42b3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x433f80
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x442b44]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x14]
call fcn.00423940
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0
call fcn.0042b130
push 0x438300
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 1
call fcn.00424630
push 0x5c
lea ecx, [esp + 0x10]
call fcn.004043c6
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b48d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.0042cc50
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x42b4c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x42b4d9
pop esi
xor al, al
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push ebx
push edi
neg ecx
or ecx, eax
push ecx
call fcn.004033ca
add esp, 4
mov edi, eax
push edi
push esi
mov bl, 1
call ebp
test eax, eax
jne 0x42b512
push edi
xor bl, bl
call fcn.004033cf
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.0040424d
push edi
call fcn.004033cf
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
Function at 0x430b06
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x442b44]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430a9b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040dc70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x430b55
cmp dword [ebp - 0x1c], 5
jb 0x430b6d
jmp 0x430b69
cmp dword [ebp - 0x10], 1
jne 0x430b6d
cmp dword [ebp - 0x1c], 4
ja 0x430b69
jne 0x430b6d
cmp dword [ebp - 0x18], 0
jbe 0x430b6d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43c3a8
call fcn.0043096f
test eax, eax
jge 0x430b8e
mov byte [0x447418], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e93a
add ebp, 0x78
leave
ret
Function at 0x431c59
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x431c86
call fcn.0040fcdc
mov dword [eax], esi
call fcn.0040fcc9
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040e574
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x431c62
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x431cb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040fcef
pop ecx
call fcn.0040fcc9
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x431cdc
test al, 1
je 0x431cdc
test byte [esp + 0xc], 2
je 0x431cdc
call fcn.0040fcdc
mov dword [eax], 5
call fcn.0040fcc9
mov dword [eax], 0xd
jmp 0x431cac
xor eax, eax
pop esi
ret

Function at 0x420870
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420876
ret
Function at 0x408000
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x408175
cmp dword [esp + 0x54], 0x40
jne 0x408175
cmp word [esp + 0x10], 0x5a4d
jne 0x408175
mov edx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x408175
lea eax, [esp + 0x54]
push 0
push eax
push 0xf8
push 0x40e960
push esi
call ebx
test eax, eax
je 0x408175
cmp dword [esp + 0x54], 0xf8
jne 0x408175
cmp dword [0x40e960], 0x4550
jne 0x408175
mov eax, dword [0x40e976]
test ah, 0x20
jne 0x408175
mov edx, dword [0x40ea80]
xor eax, eax
mov ax, word [0x40e966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x40ea58], eax
je 0x408175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x40ea6c], eax
xor eax, eax
mov ax, word [0x40e966]
mov edx, dword [0x40ea58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x408175
cmp dword [esp + 0x54], edi
jne 0x408175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x40ea80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x40e9b4]
cmp edx, eax
ja 0x408175
mov edi, dword [0x40ea58]
mov ecx, dword [0x40e988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x408175
xor eax, eax
push 2
mov ax, word [0x40e966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x408175
cmp dword [edi - 0x20], ebx
ja 0x408175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x40a769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40e190
cmp edx, dword [eax]
je 0x40a78b
add eax, 8
inc ecx
cmp eax, 0x40e220
jl 0x40a77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40e190]
jne 0x40a8b9
mov eax, dword [0x40ebb0]
cmp eax, 1
je 0x40a893
test eax, eax
jne 0x40a7bc
cmp dword [0x40e0e4], 1
je 0x40a893
cmp edx, 0xfc
je 0x40a8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040b670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040b490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40a836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040b490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d45c
push edi
call fcn.0040bf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040b670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040b680
lea eax, [ebp - 0xa0]
push 0x40d43c
push eax
call fcn.0040b680
push dword [esi + 0x40e194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040b680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040be75
add esp, 0x2c
pop edi
jmp 0x40a8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40e194]
push 0
push eax
push dword [esi]
call fcn.0040b490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret