joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4266c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426708
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426708
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426708
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426708
cmp dword [ecx + 0x74], 0xe
jbe 0x426708
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438add
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0xa00058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa001a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa0007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0006a
add dl, dl
jne 0xa00089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa000dc
xor eax, eax
add dl, dl
jne 0xa00096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0017d
add dl, dl
jne 0xa000a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa000b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa000bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa000c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa000d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa00075
mov eax, 1
add dl, dl
jne 0xa000ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa000f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa000e1
sub eax, ebx
mov ebx, 1
jne 0xa00128
mov ecx, 1
add dl, dl
jne 0xa0010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa00119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa00105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa00075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa0013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa00136
cmp eax, 0x7d00
jae 0xa0016d
cmp eax, 0x500
jb 0xa00168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa00075
cmp eax, 0x7f
ja 0xa00170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa00075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa0019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa00075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4071b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4071ef
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4071c8
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x4071c3
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40721c
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4071fd
not eax
pop ebp
ret 0xc

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0xe633da3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
mov ecx, 0x68e74cb
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401e2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0041382b
mov esi, eax
cmp esi, 0xc350
pop ecx
jae 0x401e4e
xor al, al
jmp 0x401eb9
push edi
push esi
call fcn.00410bf4
push esi
mov edi, eax
push ebx
push edi
call fcn.00421c60
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [0x42a1d8]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401eae
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push edi
push eax
call dword [0x42a1dc]
push dword [ebp - 0xc]
call dword [0x42a1e0]
push esi
push edi
call fcn.00401647
test al, al
pop ecx
pop ecx
je 0x401eae
mov byte [ebp - 1], 1
push edi
call fcn.00410c3b
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ebd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp byte [0x4594f2], bl
jne 0x401ed8
xor al, al
jmp 0x401f9a
push edi
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x14c], bl
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
push 0x458ff0
lea eax, [ebp - 0x14c]
push eax
call dword [0x42a1ec]
lea eax, [ebp - 0x14c]
push eax
call dword [0x42a214]
lea eax, [ebp + eax - 0x14c]
push 0x27
push eax
call fcn.00413732
lea eax, [ebp - 0x14c]
push eax
call fcn.00413a97
add esp, 0xc
test eax, eax
je 0x401f97
push 0x10
xor eax, eax
pop ecx
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0041a836
test eax, eax
pop ecx
pop ecx
je 0x401f97
push 0x40
lea eax, [ebp - 0x44]
push 0x4594f3
push eax
call fcn.004224e1
add esp, 0xc
test eax, eax
jne 0x401f91
lea eax, [ebp - 0x14c]
push eax
call fcn.00401e2a
test al, al
pop ecx
je 0x401f91
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x14c]
push eax
call dword [0x42a218]
test eax, eax
je 0x401f91
mov al, 1
jmp 0x401f99
mov byte [0x4594f2], bl
xor al, al
pop edi
pop ebx
leave
ret
Function at 0x411608
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
pop ecx
xor eax, eax
push 0x100
push eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
push ebx
rep stosd dword es:[edi], eax
call fcn.00421c60
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.0041a715
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00417376
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.00421920
add esp, 0x28
push 0x40
lea edi, [ebx + 0x60]
lea esi, [ebx + 0x5a]
pop ecx
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + ebx + 0x9f]
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x20
mov byte [eax + ebx + 0x9f], cl
jl 0x411663
push dword [ebp + 8]
call dword [0x42a214]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4116a1
mov al, byte [ecx + ebx + 0xbd]
xor al, byte [ecx + ebx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebx + 0xbf], al
jl 0x41168b
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4136ff
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x458d98
inc esi
call dword [0x42a214]
movzx eax, al
xor ecx, ecx
test eax, eax
jbe 0x41372e
push edi
movzx edx, byte [ecx + 0x458d98]
mov edi, edx
imul edi, esi
xor edi, edx
inc ecx
cmp ecx, eax
mov esi, edi
jb 0x413718
pop edi
mov eax, esi
pop esi
ret

Function at 0x41382b
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x24]
call dword [0x42a1d8]
mov esi, eax
push edi
push esi
call dword [0x42a108]
push esi
mov edi, eax
call dword [0x42a1e0]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x413a97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x42a210]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x413aac
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
call dword [0x42a20c]
push eax
call fcn.00421d78
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [0x42a128]
mov word [ebp - 0x28], 0x7d9
call fcn.00421d82
cdq
push 7
pop ecx
idiv ecx
mov word [ebp - 0x26], dx
call fcn.00421d82
push 0x12
cdq
pop ecx
idiv ecx
mov esi, dword [0x42a124]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x22], dx
call esi
inc word [ebp - 0x26]
add word [ebp - 0x22], 2
call fcn.00421d82
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.00421d82
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.00421d82
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
call fcn.00421d82
cdq
push 2
pop ecx
idiv ecx
add word [ebp - 0x22], 3
add word [ebp - 0x26], dx
call fcn.00421d82
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.00421d82
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.00421d82
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [0x42a1d8]
mov esi, eax
cmp esi, 0xffffffff
je 0x413bcc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [0x42a120]
push esi
call dword [0x42a1e0]
pop esi
leave
ret
Function at 0x414ef4
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00413a97
test eax, eax
pop ecx
jne 0x414f08
mov al, 1
pop esi
ret
push esi
call fcn.00413f8e
pop ecx
push 0x80
push esi
call dword [0x42a10c]
push esi
call fcn.00413d02
pop ecx
push esi
call dword [0x42a204]
test eax, eax
setne al
pop esi
ret

Function at 0x415755
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
mov esi, dword [0x42a290]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov edi, 0x4156f5
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call esi
cmp dword [ebp - 0xc], ebx
jne 0x415797
cmp dword [ebp - 4], ebx
je 0x415797
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret

Function at 0x415cfe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
and dword [ebp - 4], 0
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [0x42a1d8]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415d32
xor eax, eax
jmp 0x415d77
push 0x258
lea eax, [ebp - 0x260]
push eax
push 0x42f310
call fcn.00413410
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [0x42a214]
push eax
lea eax, [ebp - 0x260]
push eax
push edi
call dword [0x42a1d4]
push edi
call dword [0x42a1e0]
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x41a0bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0x10000
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + edx*4]
mov edx, ecx
and ecx, 0xffff
shr edx, 0x10
mov esi, ecx
mov dword [ebp - 8], ecx
mov ecx, edx
imul ecx, edx
mov dword [eax + 4], ecx
mov ecx, esi
imul ecx, esi
mov dword [eax], ecx
mov ebx, edx
sub ebx, esi
sub esi, edx
mov ecx, esi
imul ecx, ebx
xor esi, ebx
mov ebx, dword [eax + 4]
and esi, edi
neg esi
mov dword [ebp - 4], edx
mov edx, ecx
neg edx
sbb edx, edx
and edx, esi
add ecx, ebx
cmp ecx, ebx
sbb esi, esi
and esi, edi
add edx, esi
mov esi, dword [eax]
add ecx, esi
cmp ecx, esi
sbb esi, esi
and esi, edi
add edx, esi
mov esi, ecx
shl esi, 0x10
add dword [eax], esi
cmp dword [eax], esi
sbb esi, esi
neg esi
shr ecx, 0x10
add esi, ebx
add ecx, esi
add ecx, edx
mov dword [eax + 4], ecx
add eax, 8
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x10]
jl 0x41a0d1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422b93
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42b7f8
call fcn.0042238c
mov edi, 0x94
mov eax, edi
call fcn.00421df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x42a084]
mov ecx, dword [esi + 0x10]
mov dword [0x463b28], ecx
mov eax, dword [esi + 4]
mov dword [0x463b34], eax
mov edx, dword [esi + 8]
mov dword [0x463b38], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x463b2c], esi
cmp ecx, 2
je 0x422bf3
or esi, 0x8000
mov dword [0x463b2c], esi
shl eax, 8
add eax, edx
mov dword [0x463b30], eax
xor esi, esi
push esi
mov edi, dword [0x42a07c]
call edi
cmp word [eax], 0x5a4d
jne 0x422c2e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x422c2e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x422c46
cmp eax, 0x20b
je 0x422c33
mov dword [ebp - 0x1c], esi
jmp 0x422c5a
cmp dword [ecx + 0x84], 0xe
jbe 0x422c2e
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x422c54
cmp dword [ecx + 0x74], 0xe
jbe 0x422c2e
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00425b9f
pop ecx
test eax, eax
jne 0x422c86
cmp dword [0x463b08], 1
jne 0x422c73
call fcn.00425354
push 0x1c
call fcn.004251dd
push 0xff
call fcn.00423d5c
pop ecx
pop ecx
call fcn.00425afd
mov dword [ebp - 4], esi
call fcn.00425952
test eax, eax
jge 0x422c9f
push 0x1b
call fcn.00422b6e
pop ecx
call dword [0x42a1c8]
mov dword [0x4650f0], eax
call fcn.00425830
mov dword [0x463b00], eax
call fcn.0042578e
test eax, eax
jge 0x422cc5
push 8
call fcn.00422b6e
pop ecx
call fcn.0042555b
test eax, eax
jge 0x422cd6
push 9
call fcn.00422b6e
pop ecx
push 1
call fcn.00423d8c
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x422cec
push eax
call fcn.00422b6e
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x42a1cc]
call fcn.004254fe
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x422d0d
movzx eax, word [ebp - 0x40]
jmp 0x422d10
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040da5b
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x422d2e
push edi
call fcn.00423eb7
call fcn.00423ed9
jmp 0x422d60
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004223c7
ret

Function at 0x424093
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x42a210]
cmp eax, 0xffffffff
jne 0x4240b3
call dword [0x42a0b8]
push eax
call fcn.004270f9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4240d4
test byte [esp + 8], 2
je 0x4240d4
mov dword [0x463b1c], 0xd
mov dword [0x463b20], 5
jmp 0x4240af
xor eax, eax
ret
Function at 0x4043a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x4043f0
cmp esi, edi
ja 0x404458
cmp edi, dword [esp + 0x1c]
ja 0x404466
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x4043f2
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4043e0
jmp 0x40444f
ja 0x4043f8
cmp eax, edx
mov esi, edi
jne 0x4043b3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x404430
mov ebp, esi
sub ecx, edx
jns 0x404447
jmp 0x404451
cmp esi, edi
je 0x404476
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x404451
xor al, 1
cmp ebp, edi
jne 0x404410
jmp 0x404451
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x418dd4
call fcn.004165f0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x418dd4
call fcn.00416400
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x418dc4
call fcn.00416460
int3
Function at 0x40bb80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x415220
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x41e124]
test al, al
je 0x40bd51
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40bbcc
cmp eax, 3
jne 0x40bd4a
mov ebx, dword [0x41e128]
test ebx, ebx
je 0x40bd4a
mov dword [ebp - 0x20], 0
jmp 0x40bbf7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bc28
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bd9b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bbf0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bbf0
test byte [ebp - 0x20], 1
je 0x40bd4a
mov ebx, dword [0x41e128]
test ebx, ebx
je 0x40bd4a
mov dword [ebp - 0x20], 0
jmp 0x40bc57
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bc88
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bd9b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bc50
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bc50
test byte [ebp - 0x20], 1
je 0x40bd4a
mov ebx, dword [0x41e128]
test ebx, ebx
je 0x40bd4a
mov dword [ebp - 0x20], 0
jmp 0x40bcb7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bce8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bd9b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bcb0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bcb0
test byte [ebp - 0x20], 1
je 0x40bd4a
mov ebx, dword [0x41e128]
test ebx, ebx
je 0x40bd4a
mov dword [ebp - 0x20], 0
jmp 0x40bd17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bd44
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bd9b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bd10
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bd10
test byte [ebp - 0x20], 1
jne 0x40bd64
movzx eax, byte [0x41be80]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x41e128]
jmp 0x40bd6f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bd4a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bd9b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bd6c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x40bd6c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x41b788
call fcn.00416460
add esp, 4
ud2
Function at 0x40c780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x41e048]
test eax, eax
je 0x40c833
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40c7ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x40c7ac
add edi, 8
jmp 0x40c82e
mov eax, dword [0x41e048]
test eax, eax
je 0x40c842
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40c82c
mov esi, eax
test eax, eax
jne 0x40c802
movzx eax, byte [0x41e0a8]
mov ecx, 0xc
call fcn.004050b0
test eax, eax
je 0x40c85d
mov dword [eax], 0x41e048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x41e048]
test eax, eax
je 0x40c851
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x40c82e
test ecx, ecx
je 0x40c82e
lock dec dword [ecx]
jne 0x40c82e
call fcn.0040c480
jmp 0x40c82e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x41e048
call fcn.00416dd0
jmp 0x40c790
mov ecx, 0x41e048
call fcn.00416dd0
jmp 0x40c7ba
mov ecx, 0x41e048
call fcn.00416dd0
jmp 0x40c7fa
mov ecx, 4
mov edx, 0xc
call fcn.00416270
int3

Function at 0x40cd40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x41e058]
test eax, eax
je 0x40cdbf
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40cd5f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x40cdb4
mov eax, dword [0x41e058]
test eax, eax
je 0x40cdcb
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40cdb9
mov esi, eax
test eax, eax
jne 0x40cdae
movzx eax, byte [0x41e0a8]
mov ecx, 8
call fcn.004050b0
test eax, eax
je 0x40cde3
mov dword [eax], 0x41e058
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x41e058]
test eax, eax
je 0x40cdd7
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x40cdbb
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x41e058
call fcn.00416dd0
jmp 0x40cd4b
mov ecx, 0x41e058
call fcn.00416dd0
jmp 0x40cd69
mov ecx, 0x41e058
call fcn.00416dd0
jmp 0x40cda6
mov ecx, 4
mov edx, 8
call fcn.00416270
int3