joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x78f855c4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x403642b1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43196e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x43197d
pop dword [ebp - 0x2c]
mov eax, 0xb4d1a831
add eax, 0x4b71714c
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3b5b0
push 0
mov eax, 0xc8389bf3
sub eax, 0xc7f51bc3
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x1b58e464
add ecx, 0xe4a76633
mov edi, eax
mov esi, 0x44c600
add esi, dword [ebp - 0x2c]
mov ebx, 0xb72dcbcb
add ebx, 0x11fda086
sub dword [ebp - 0x10], edi
mov edx, dword [esi]
mov dword [ebp - 0x1c], 0xd6dbc85e
add edx, ebx
xor dword [ebp - 0x28], edi
mov dword [edi], edx
mov dword [ebp - 0x28], 0x32948b2e
add edi, 0xa45245c1
sub edi, 0xa45245bd
add esi, 4
loop 0x4319d6
add eax, 0xe6e62a97
add eax, 0x191af298
mov ebx, eax
add eax, 5
mov ecx, 0xc6d2db5
sub ecx, 0xc2d2db5
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x1020999c
Capabilities:
Encode data using xor

Disassembly:
call fcn.10205682
std
popal
sub al, 0x31
mov dh, 0xee
or byte [ebx], dl
stc
xchg ecx, eax
lodsd eax, dword [esi]
stc
and dh, ch
test edx, ecx
cmp esi, dword [ecx + 0x1c]
popal
pop edx
sal bl, cl
sub esp, edx
cdq
push es
sahf
pop ss
lea edi, [eax + 0x19]
add ebp, dword [ebx]
in al, 0x42
sub eax, 0xd142384c
inc ecx
inc ebp
mov dh, byte [edx]
sbb dh, ch
push ss
push edi
and al, 0xdf
sub esi, edi
lcall 0x6fc5, 0xad8da41
and dword [edx - 0x38], 0xffffffab
adc eax, 0x119e52c9
pushal
aaa
mov dl, 0x1e
adc byte [eax - 0x2a237985], 0x26
jle 0x10209a28
cmp bh, byte [ebx + 0x36d592f1]
cli
ror byte [esi], 1
and ch, byte [eax]
movsd dword es:[edi], dword [esi]
in eax, dx
shl byte [eax - 0x7e], 1
inc esi
add dword [0xa488cbde], esi
call dword [edx]
xor eax, 0xae2d5975
push es
dec esp
out dx, eax
push ss
dec ebp
pop ecx
fdiv dword [0x2ff7d528]
pushal
invalid
add edx, dword [eax + 0x60]
popfd
dec esp
lodsd eax, dword [esi]
xor ah, byte [esi - 0x35]
xor eax, 0x20841b17
dec edx
sub al, byte [esi + 0x7a]
pop edi
dec eax
jbe 0x10209a11
out dx, eax
mov bl, 4
mov al, byte [0xdcf8aece]
lds edx, [edi]
jge 0x10209ab8
xchg esp, eax
mov dl, dl
ret 0x410
mov ah, 0x30
sal byte [eax], 0xe8
xor byte [ebp + 0x31], dl
outsd dx, dword [esi]
xor dword [ebx - 0x3ace6acf], eax
xor edi, ecx
xor esi, ebx
xor edx, ebp
xor dword [eax - 0x34cd48ce], ebp
xor bl, dl
xor ch, cl
xor bh, al
xor al, byte [edx]
xor edx, dword [eax]
xor esp, dword [edi]
xor esi, dword [esi]
xor eax, dword [ebp + 0x33]
pop ecx
xor ebp, dword [eax + 0x33]
ja 0x10209b1d
xor dword [ebx], 0x33a8338f
mov edx, 0xd833c933
xor esp, edi
xor esi, esi
xor eax, dword [eax]
xor al, 0xe
xor al, 0x25
xor al, 0x34
xor al, 0x43
xor al, 0x57
xor al, 0x66
xor al, 0x75
xor al, 0x7f
xor al, 0x89
xor al, 0xe2
xor eax, 0x360635f4
or eax, 0x32362336
inc ecx
dec ebx
arpl word ss:[esi], si
jb 0x10209b58
test byte [esi], dh
mov esi, dword [esi]
mov eax, dword [0xbf36b036]
leave
loop 0x10209b66
div byte [esi]
or byte [edi], dh
getsec
and byte [edi], dh
das
aaa
aaa
dec eax
aaa
popal
aaa
jo 0x10209b79
xor byte [edi], 0x89
aaa
lahf
aaa
scasb al, byte es:[edi]
aaa
mov ebp, 0xf237c737
cmp byte [ecx + edi], al
push ss
cmp dword [0x42393339], ebx
inc edx
cmp dword [ecx + 0x39], edx
pop ebx
cmp dword [ebx + 0x39], esi
cmp byte [ecx], 0x94
cmp dword [ebx - 0x3fc64ec7], ebx
cmp edi, ecx
mov cl, 0x39
sar byte [ecx], 0xcf
cmp ecx, ebx
cmp edx, esi
cmp dword [esi], eax
cmp bl, byte [eax]
cmp bl, byte [edi]
cmp dh, byte [eax]
cmp bh, byte [edi]
cmp cl, byte [esi + 0x3a]
pop eax
cmp dh, byte [ecx + 0x3a]
cmp byte [edx], 0x92
cmp bl, byte [ecx - 0x41c550c6]
cmp cl, ch
cmp dl, bh
cmp al, byte [edi + 0x3c3e7f3b]
aas
dec ecx
aas
add byte [eax], al
add byte [eax], dh
add byte [eax], al
mov word [eax], es
add byte [eax], al
pop ss
xor byte [edx], ah
xor byte [edi], ah
xor byte [edi], ch
xor byte [edx + 0x6d321830], dh
xor dh, bl
xor al, 0xf8
xor al, 0xfd
xor al, 2
xor eax, 0x350d3507
sbb dword [0x352d3524], esi
xor dh, byte [0x35433538]
dec eax
xor eax, 0x3556354e
push 0x35
invalid
Function at 0x4012bf
Capabilities:
Encode data using base64

Disassembly:
pop edx
add bl, al
push 0x630a50
call fcn.00599956
mov dword [esp], 0x59f3b4
call fcn.005696f0
pop ecx
ret
jne 0x4012b6
push dword [ebp + 8]
call fcn.00401307
add esp, 0x10
neg eax
fcomp dword [ebx]
rol byte [eax + 0x5f], 0x5e
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
push ebx
call fcn.0042aa12
test al, al
je 0x4012eb
pop ebx
stosb byte es:[edi], al
loop 0x401308
and ah, byte [eax]
insb byte es:[edi], dx
pushal
sbb eax, 0x3fdc8053
jo 0x4012a8
int 0x91
xchg ecx, eax
jge 0x40125e
inc edx
popfd
inc esi
stc
bound edx, qword [edx]
shl ch, cl
je 0x4012da
movsb byte es:[edi], byte [esi]
pop edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040147b
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
Function at 0x401307
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0042ae62
test al, al
je 0x401328
dec ebp
push esp
dec esi
inc esp
mov es, word [edx - 0x12c2cc12]
mov word [edx - 0x45], es
add bh, byte [edx - 0x15]
adc eax, ebp
cwde
add al, byte [eax]
jmp 0x401339
call fcn.0042ab6b
test al, al
je 0x401350
cwde
aad 0xbf
xor eax, 0xd84c6686
add ebx, dword [ecx]
xchg ebx, eax
pop ds
push ebx
mov cl, 0x99
push edi
loopne 0x4013ac
popfd
mov dword [ebx + 4], ecx
inc ecx
push ss
inc eax
sbb eax, 0xfe4e79c0
call fcn.0042a988
test al, al
je 0x40136f
xchg esi, eax
xchg esi, eax
je 0x401326
mov ah, 0x33
and edi, esi
dec ebx
add ebx, dword [eax]
popfd
and eax, 0x4c548e3f
push esp
movsd dword es:[edi], dword [esi]
mov ebx, 0x33c93361
sal byte [ebx], cl
fstp xword [ecx]
dec ebp
or al, 0xf
invalid
xor ecx, ecx
xor edx, edx
xor ebx, ebx
cmp dword [ebp + 0xc], ecx
jle 0x401472
mov esi, dword [ebp + 8]
mov al, byte [ebx + esi]
cmp al, 0x3d
jne 0x40138e
inc edx
cmp edx, 2
jg 0x4013cf
cmp al, 0x7f
ja 0x4013cf
movzx eax, al
mov al, byte [eax + 0x5a0580]
cmp al, 0x7f
je 0x4013cf
cmp al, 0x40
jae 0x4013a7
test edx, edx
jne 0x4013cf
inc ecx
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp + 0xc]
jl 0x401381
test ecx, ecx
je 0x401472
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x4013d7
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x4013d1
push 0xffffffffffffffee
pop eax
jmp 0x401474
call fcn.0042ae1d
test al, al
je 0x4013f8
adc ch, byte [esi + 0x3146a59b]
mov esi, 0x7cb4d173
sahf
push 0x6d
inc esp
test eax, 0x5d8b1c48
cld
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push 3
pop esi
test ebx, ebx
jle 0x40146d
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov cl, byte [eax + 0x5a0580]
xor eax, eax
cmp cl, 0x40
sete al
sub esi, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
and eax, 0x3f
shl ecx, 6
or ecx, eax
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
cmp eax, 4
jne 0x401464
xor eax, eax
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x40144f
mov eax, ecx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp esi, 1
jle 0x40145c
mov eax, ecx
shr eax, 8
mov byte [edx], al
inc edx
cmp esi, 2
jle 0x401464
mov byte [edx], cl
inc edx
dec ebx
inc edi
test ebx, ebx
jg 0x40140e
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401682
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + 0x210]
mov dword [ebp - 8], eax
mov esi, dword [ecx]
push edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [eax + 0x214]
je 0x401750
lea edi, [esi + 0x28]
mov dword [ebp + 8], edi
lea ecx, [ebx + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a06c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a06c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a06c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a06c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.005747e0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x401730
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.005747e0
pop ecx
pop ecx
test eax, eax
je 0x40174c
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
je 0x401750
jmp 0x4016b4
mov byte [ebp - 1], 1
call fcn.0042a8b9
test al, al
je 0x401769
popal
dec edx
daa
invalid
cmp byte [ebp - 1], 0
jne 0x40178d
lea edx, [ebx + 0xa8]
push edx
call fcn.00574870
pop ecx
test eax, eax
je 0x40178d
mov ecx, dword [ebp - 0xc]
push ebx
call fcn.0040256d
mov al, 1
jmp 0x40178f
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40243a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
push edi
mov dword [ebp - 0x11c], ecx
mov dword [ecx + 0x214], eax
call fcn.0042ac3a
test al, al
je 0x40247f
mov cl, bl
test dword fs:[ebp - 0x6ed3c1b4], ebp
Function at 0x403c02
Capabilities:
Link many functions at runtime

Disassembly:
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
or byte [eax], al
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.0042ae62
test al, al
je 0x403c35
mov bl, 0x61
mov dword [0xcf579d9d], eax
push ds
push edi
mov eax, dword [0x72a3d31c]
lodsb al, byte [esi]
loope 0x403bd8
call fcn.0042ab6b
test al, al
je 0x403c5d
inc ebx
cdq
or eax, 0x6d52cd6b
in al, dx
aas
clc
nop dword [edi + 0x35]
sub edi, ebx
in al, 0xea
je 0x403c00
dec ecx
dec eax
or byte [ebx + 0x17], ch
push edi
movsd dword es:[edi], dword [esi]
sbb dword [edx], 0x6d26e836
add al, byte [eax]
call fcn.0042a988
test al, al
je 0x403c7c
xor eax, ebp
mov ah, 0x22
cwde
push ds
xor dword [esi + 1], edi
popal
jmp 0xc76f029e
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x403c8b
xor eax, eax
jmp 0x403d55
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.0042ab6b
test al, al
je 0x403cff
insd dword es:[edi], dx
sub eax, 0x8d9cb4ef
pop edi
dec ecx
popal
movsb byte es:[edi], byte [esi]
dec eax
ficom dword [edi]
loop 0x403d4a
and byte [esi], dh
ret
call fcn.0042aa12
test al, al
je 0x403d26
mov eax, 0x2eaf79e5
and al, byte [edx + 0xe]
cli
fistp dword [eax + eax*4 + 0x7fae779c]
xchg ebx, eax
std
fdivr dword [ebx - 0x80]
outsd dx, dword [esi]
pop ds
add esi, ebx
inc edi
cmp eax, 0x8bf81ada
jne 0x403d25
clc
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x403c84
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405280
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x405aec
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0042ab6b
test al, al
je 0x405b1a
inc ebx
lds ebp, [ecx]
pop ebx
inc ebx
std
idiv byte [ecx + 0x4c28ea39]
aas
insd dword es:[edi], dx
xchg ecx, eax
pop es
retf 0x576d
call fcn.0042aa12
test al, al
je 0x405b41
inc ecx
stc
or dword fs:[edi - 0x2e4dae8b], 0x17bac80d
pop ecx
xchg ebp, eax
pop edx
lahf
and ch, bh
pushfd
pop esp
popfd
stc
daa
and dword [eax - 0x67], esi
arpl word [ebx - 0x2b], cx
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
pop edi
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405e14
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5a09b8
call fcn.00578706
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00578ed3
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.0056f390
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.0056f390
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.0056f390
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x405f12
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00402755
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00403edb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x407e44
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0056f390
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x407e7d
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5a0b04
push eax
call fcn.00408d5e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407eb5
lea eax, [ebp - 0x20c]
push eax
call int.00413d60
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0056f390
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5a0ac0
push eax
call fcn.00408d5e
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x407ef4
mov eax, esi
jmp 0x407f01
lea eax, [ebp - 0x414]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00403772
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0056f390
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5a0ac0
push eax
call fcn.00408d5e
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x407f53
mov eax, esi
jmp 0x407f60
lea eax, [ebp - 0x61c]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00403772
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0056f390
lea eax, [ebp - 0xa44]
push str.ShxlPath
push eax
call fcn.00415167
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x407fa1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5a0b58
push eax
call fcn.00408d5e
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00403628
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407fe2
lea eax, [ebp - 0x824]
push eax
call int.00413d60
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.0056f390
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5a0ac0
push eax
call fcn.00408d5e
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x40802c
lea eax, [ebp - 0xa2c]
push eax
call fcn.00578706
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00403772
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x4119ed
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x61c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x208
mov dword [ebp - 0x628], esi
push edi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.0056f390
push edi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056f390
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00578f87
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00578f87
lea eax, [ebp - 0x61c]
push eax
call fcn.0057c0eb
lea eax, [ebp - 0x414]
push eax
call fcn.0057c0eb
add esp, 0x30
call fcn.0042a8b9
test al, al
je 0x411a86
push 0x32
retf 0x2c66
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00578f47
pop ecx
pop ecx
test eax, eax
je 0x411c35
test esp, esp
stc
invalid
call fcn.0042ad4e
test al, al
je 0x411ac9
dec edi
mov al, byte [0xfb89cdb3]
jno 0x411a8e
jno 0x411a38
in eax, 0xca
invalid
call fcn.0042ae62
test al, al
je 0x411af0
fild dword [esi]
idiv dword [ecx]
xchg ebx, ebp
adc eax, 0x298d0b54
adc al, 0xdc
mov eax, 0x112c6ead
push 0xffffffffffffffc2
retf
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x624], ebx
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
test ebx, ebx
jne 0x411b2e
push dword [ebp - 0x620]
push 0x5a362c
push eax
call fcn.00408d5e
add esp, 0xc
jmp 0x411b43
push ebx
push dword [ebp - 0x620]
push str._s.bak_d
push eax
call fcn.00408d5e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411b61
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0042a8b9
test al, al
je 0x411b7a
mov ss, word [esi - 0x78fbe035]
int1
mov ebx, esp
mov word [0x6bb86f2f], ax
int3
mov esi, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0057c21a
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x411c24
call fcn.0042ad4e
test al, al
je 0x411bdb
salc
stosb byte es:[edi], al
retf 0xa538
call fcn.0042ae62
test al, al
je 0x411c08
xchg edi, eax
sub cl, cl
mov bl, 0x67
add al, dl
jno 0x411c3b
cmp al, 0x9b
mov edx, 0x7c89118d
int 0x53
sbb al, 0xec
ret 0x83e5
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x411c35
inc ebx
jmp 0x411af2
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
int 0x5b
call fcn.0056935c
mov esp, ebp
pop ebp
ret