joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x418311
mov eax, dword [esi]
jmp 0x418313
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x418330
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea eax, [ebp - 0x44]
push edi
push 0x455f0c
push eax
call fcn.004192a0
add esp, 0xc
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.00402220
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x24c]
push eax
call ebx
test eax, eax
je 0x4183c6
mov edi, edi
inc edi
lea eax, [ebp - 0x44]
push edi
push 0x455f0c
push eax
call fcn.004192a0
add esp, 0xc
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.00402220
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x24c]
push eax
call ebx
test eax, eax
jne 0x418380
push 0
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp - 0x24c], 0
pop edi
jne 0x4183e4
xor ecx, ecx
jmp 0x4183ff
lea ecx, [ebp - 0x24c]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4183f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x24c]
mov ecx, esi
push eax
call fcn.00402490
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.00428e73
mov esp, ebp
pop ebp
ret

Function at 0x418430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x103
jb 0x418470
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x208
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x4184ce
cmp word [ebp - 0x61c], 0
jne 0x4184ae
xor ecx, ecx
lea eax, [ebp - 0x61c]
jmp 0x4184fa
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4184b7
sub ecx, edx
lea eax, [ebp - 0x61c]
sar ecx, 1
jmp 0x4184fa
cmp word [ebp - 0x20c], 0
jne 0x4184dc
xor ecx, ecx
jmp 0x4184f4
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4184e5
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x20c]
push ecx
push eax
mov ecx, esi
call fcn.00402490
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x418520
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x449b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x45e4b8]
xor eax, esp
mov dword [esp + 0x680], eax
push ebx
push esi
push edi
mov eax, dword [0x45e4b8]
xor eax, esp
push eax
lea eax, [esp + 0x698]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [esp + 0x48c], ax
lea eax, [esp + 0x48e]
push eax
call fcn.0042ea00
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x41858c
mov eax, dword [esi]
jmp 0x41858e
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x455f14
push eax
lea eax, [esp + 0x48c]
push eax
call ebx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x418741
xor eax, eax
push 0x206
push eax
mov word [esp + 0x284], ax
lea eax, [esp + 0x286]
push eax
call fcn.0042ea00
add esp, 0xc
lea eax, [esp + 0x58]
test byte [esp + 0x2c], 0x10
je 0x418705
mov ecx, 0x455f18
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41861c
test dx, dx
je 0x418618
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41861c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4185f6
xor eax, eax
jmp 0x418621
sbb eax, eax
or eax, 1
test eax, eax
je 0x418726
mov ecx, 0x455f1c
lea eax, [esp + 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418658
test dx, dx
je 0x418654
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418658
add eax, 4
add ecx, 4
test dx, dx
jne 0x418632
xor eax, eax
jmp 0x41865d
sbb eax, eax
or eax, 1
test eax, eax
je 0x418726
lea eax, [esp + 0x58]
mov ecx, esi
push eax
call fcn.00402220
push eax
lea eax, [esp + 0x284]
push eax
call ebx
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
cmp word [esp + 0x27c], ax
jne 0x4186a1
xor ecx, ecx
jmp 0x4186bf
lea ecx, [esp + 0x27c]
lea edx, [ecx + 2]
jmp 0x4186b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4186b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402490
lea ecx, [esp + 0x14]
mov dword [esp + 0x6a0], 0
call fcn.00418520
mov dword [esp + 0x6a0], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x418726
push dword [esp + 0x14]
call fcn.00429834
add esp, 4
jmp 0x418726
push eax
mov ecx, esi
call fcn.00402220
push eax
lea eax, [esp + 0x284]
push eax
call ebx
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4185c2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 8
jb 0x418749
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x680]
xor ecx, esp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x418870
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x4188db
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 8]
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret

Function at 0x4188f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449b88
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 5
xor eax, eax
mov dword [ebp - 0x174], 0
push str.Other
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00402490
push 0x11c
lea eax, [ebp - 0x170]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0042ea00
add esp, 0xc
mov dword [ebp - 0x170], 0x11c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.default.0x4189e4
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
cmp ecx, 5
jne 0x4189d4
cmp eax, 1
jne 0x4189a9
push 0xa
push str.Windows_XP
jmp 0x418a33
cmp eax, 2
jne 0x4189d4
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp byte [ebp - 0x56], 1
jne case.default.0x4189e4
cmp word [ebp - 0x4c], 9
jne case.default.0x4189e4
push str.Windows_XP
lea ecx, [ebp - 0x28]
call fcn.00402050
jmp case.default.0x4189e4
cmp byte [ebp - 0x56], 1
jne 0x418a2c
cmp ecx, 6
jne 0x418a18
cmp eax, 4
ja case.default.0x4189e4
jmp dword [eax*4 + 0x418a74]
push str.Windows_Vista
lea ecx, [ebp - 0x28]
call fcn.00402050
jmp case.default.0x4189e4
push str.Windows_7
lea ecx, [ebp - 0x28]
call fcn.00402050
jmp case.default.0x4189e4
push str.Windows_8
lea ecx, [ebp - 0x28]
call fcn.00402050
jmp case.default.0x4189e4
cmp ecx, 0xa
jne 0x418a2c
push str.Windows_10
lea ecx, [ebp - 0x28]
call fcn.00402050
jmp case.default.0x4189e4
push 5
push str.Other
lea ecx, [ebp - 0x28]
call fcn.00402490
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00401c00
cmp dword [ebp - 0x14], 8
jb 0x418a57
push dword [ebp - 0x28]
call fcn.00429834
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x418a90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449bc9
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x38], 0
push 3
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0x455fa4
mov dword [ebp - 0x3c], esi
mov word [esi], ax
call fcn.00402490
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x418b13
cmp ax, 6
jne 0x418b21
push 3
push 0x453480
mov ecx, esi
call fcn.00402490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret

Function at 0x418b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 5
xor eax, eax
mov dword [ebp - 0x23c], 0
push str.Other
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402490
xor eax, eax
mov dword [ebp - 4], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0042ea00
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x238]
add esp, 0xc
mov dword [ebp - 0x234], 0x208
push eax
push 0x20019
push 0
push str.SoftwareClientsStartMenuInternet
push SysReAllocStringLen
call edi
test eax, eax
je 0x418c19
lea eax, [ebp - 0x238]
push eax
push 0x20019
push 0
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x418c92
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x455178
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x238]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x418c92
test edi, edi
jne 0x418c92
cmp word [ebp - 0x218], di
jne 0x418c5f
xor ecx, ecx
jmp 0x418c7f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x418c70
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418c70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402490
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401c00
cmp dword [ebp - 0x21c], 8
jb 0x418cb7
push dword [ebp - 0x230]
call fcn.00429834
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x418df0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10
mov esi, ecx
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push eax
lea eax, [ebp - 0x24]
push 0x455ef0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
cmp word [ebp - 0x24], ax
jne 0x418e42
xor ecx, ecx
jmp 0x418e5f
lea ecx, [ebp - 0x24]
lea edx, [ecx + 2]
jmp 0x418e50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418e50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00402490
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00428e73
mov esp, ebp
pop ebp
ret

Function at 0x418e80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449c78
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x418ed8
xor ecx, ecx
jmp 0x418eef
mov ecx, edx
lea edi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418ee0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402490
push 0xa
push 0
push str.passthro_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004020a0
mov edi, eax
cmp edi, 0xffffffff
jne 0x418f3a
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x455178
mov word [esi], ax
call fcn.00402490
jmp 0x418fa0
push 1
add edi, 0xa
lea ecx, [ebp - 0x28]
push edi
push 0x4560f4
call fcn.004020a0
cmp eax, 0xffffffff
jne 0x418f60
push 0x455178
mov ecx, esi
call fcn.00401ba0
jmp 0x418fa0
sub eax, edi
lea ecx, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.00401d20
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00401c00
cmp dword [ebp - 0x2c], 8
jb 0x418f8c
push dword [ebp - 0x40]
call fcn.00429834
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [ebp - 0x14], 8
jb 0x418fb1
push dword [ebp - 0x28]
call fcn.00429834
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x418fd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
cmp dword [ecx + 0x10], 0
je 0x41907b
mov edx, ecx
lea ecx, [ebp - 0x40]
call fcn.00417fa0
mov dword [ebp - 4], 0
test bl, bl
je 0x419058
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00418140
test al, al
je 0x419045
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00418050
cmp dword [ebp - 0x14], 8
jb 0x41906a
push dword [ebp - 0x28]
call fcn.00429834
add esp, 4
jmp 0x41906a
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x2c], 8
jb 0x41907b
push dword [ebp - 0x40]
call fcn.00429834
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x4190a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x14], ebx
jle 0x419274
nop
mov edx, dword [eax + ebx*4]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp word [edx], ax
je 0x419120
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419111
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00402490
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
mov edi, dword [esi + 4]
cmp eax, edi
jae 0x4191d7
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
cmp eax, ecx
ja 0x4191d7
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp edi, dword [esi + 8]
jne 0x41916c
push ecx
mov ecx, esi
call fcn.004139b0
mov eax, dword [esi]
lea ecx, [ebx + ebx*2]
mov ebx, dword [esi + 4]
lea edi, [eax + ecx*8]
test ebx, ebx
je 0x4191d2
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp dword [edi + 0x14], 8
jae 0x4191a9
mov eax, dword [edi + 0x10]
inc eax
je 0x4191b3
add eax, eax
push eax
push edi
push ebx
call fcn.00428e90
add esp, 0xc
jmp 0x4191b3
mov eax, dword [edi]
mov dword [ebx], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov ebx, dword [ebp - 0x34]
jmp 0x419248
cmp edi, dword [esi + 8]
jne 0x4191e4
push ecx
mov ecx, esi
call fcn.004139b0
mov edi, dword [esi + 4]
test edi, edi
je 0x419248
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [ebp - 0x18], 8
jae 0x41921c
mov eax, dword [ebp - 0x1c]
inc eax
je 0x419228
add eax, eax
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.00428e90
add esp, 0xc
jmp 0x419228
mov eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
add dword [esi + 4], 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x419264
push dword [ebp - 0x2c]
call fcn.00429834
add esp, 4
mov eax, dword [ebp - 0x30]
inc ebx
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x14]
jl 0x4190f0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428e73
mov esp, ebp
pop ebp
ret
Function at 0x41a1c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
movzx esi, cx
mul ebx
shr ecx, 0x10
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], ecx
sub edx, eax
mov dword [ebp - 4], edx
test edi, edi
jne 0x41a1fc
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x41a308
xor ebx, ebx
cmp edx, 7
jbe 0x41a266
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
movzx eax, byte [edi]
add ebx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, edx
jb 0x41a215
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x41a2ca
sub eax, ebx
cmp eax, 2
jb 0x41a2b6
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov ecx, ebx
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
dec edx
jne 0x41a292
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x41a2c3
movzx eax, byte [edi]
add esi, eax
add ecx, esi
inc edi
mov eax, dword [ebp - 0xc]
add eax, edx
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
jne 0x41a204
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
test esi, esi
jne 0x41a32f
xor eax, eax
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
not ecx
test edi, edi
je 0x41a370
lea esp, [esp]
mov al, byte [esi]
lea esi, [esi + 1]
movzx edx, al
mov eax, edx
shr edx, 4
xor eax, ecx
shr ecx, 4
and eax, 0xf
xor ecx, dword [eax*4 + 0x456fe0]
mov eax, ecx
shr ecx, 4
and eax, 0xf
xor edx, eax
xor ecx, dword [edx*4 + 0x456fe0]
dec edi
jne 0x41a340
not ecx
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x41eaa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41ebb8
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x41ebb8
cmp edx, dword [esi + 0x10]
jae 0x41ebb8
cmp dword [esi + 0x14], 1
jne 0x41ebb8
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edx*4]
add edi, dword [ecx]
je 0x41ebb8
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41ebb8
mov dword [ebx], edx
xor ecx, ecx
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebx + 4], eax
movzx eax, word [edi + 4]
mov word [ebx + 8], ax
movzx eax, word [edi + 6]
mov word [ebx + 0xa], ax
movzx eax, word [edi + 8]
mov word [ebx + 0xc], ax
movzx eax, word [edi + 0xa]
mov word [ebx + 0xe], ax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], 0
movzx eax, word [edi + 0x24]
mov word [ebx + 0x28], ax
mov eax, dword [edi + 0x26]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x2a]
add eax, dword [esi + 0x40]
adc ecx, dword [esi + 0x44]
mov esi, 0x103
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
movzx eax, word [edi + 0x1c]
cmp eax, esi
cmovb esi, eax
lea eax, [edi + 0x2e]
push esi
push eax
lea eax, [ebx + 0x3c]
push eax
call fcn.0042c460
mov byte [esi + ebx + 0x3c], 0
mov esi, 0xff
movzx eax, word [edi + 0x20]
cmp eax, esi
cmovb esi, eax
mov dword [ebx + 0x38], esi
movzx ecx, word [edi + 0x1e]
movzx eax, word [edi + 0x1c]
add ecx, edi
add eax, 0x2e
add eax, ecx
push esi
push eax
lea eax, [ebx + 0x140]
push eax
call fcn.0042c460
add esp, 0x18
mov byte [esi + ebx + 0x140], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x420530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x45e4b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
push 0
push ecx
push esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x42057b
mov esi, dword [edi + 4]
test esi, esi
je 0x42057b
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 4]
push eax
call dword [esi + 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428e73
mov esp, ebp
pop ebp
ret