joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c370
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43bf7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
mov eax, dword [0x44b754]
mov ecx, dword [esp + 0x244]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x23c]
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x23c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [ebx + 0x18]
push esi
mov eax, 0x10
cmp ecx, eax
push edi
lea edi, [ebx + 4]
jb 0x41c3d4
mov ecx, dword [edi]
jmp 0x41c3d6
mov ecx, edi
cmp dword [ebp + 0x18], eax
lea esi, [ebp + 4]
jb 0x41c3e2
mov eax, dword [esi]
jmp 0x41c3e4
mov eax, esi
push ecx
push eax
push str.Converting__s_at__s
push 0x44c660
call fcn.00401330
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x41c521
cmp dword [ebx + 0x18], 0x10
jb 0x41c40e
mov eax, dword [edi]
jmp 0x41c410
mov eax, edi
push eax
mov ecx, 0x44c660
call fcn.004028b0
test al, al
jne 0x41c448
push str.WARN__Free_diskspace_is_less_than_800_MB
push 0x44c660
call fcn.00401330
add esp, 8
push 4
push 0x19
mov ecx, 0x44c660
call fcn.00404d30
cmp eax, 7
je 0x41c521
mov ecx, dword [ebp + 0x18]
mov eax, 0x10
cmp ecx, eax
jb 0x41c456
mov esi, dword [esi]
cmp dword [ebx + 0x18], eax
jb 0x41c45f
mov eax, dword [edi]
jmp 0x41c461
mov eax, edi
lea edx, [esp + 0x20]
push edx
push esi
push eax
call fcn.00416710
push 0x25c
call fcn.0042a12c
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x234], 0
je 0x41c498
mov ecx, eax
call fcn.0041cbf0
mov esi, eax
jmp 0x41c49a
xor esi, esi
lea eax, [esp + 0x20]
mov dword [esp + 0x234], 0xffffffff
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c4b0
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 0xc]
call fcn.00403210
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [esi + 0x28]
call fcn.00403120
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0x250]
push edx
mov edx, dword [esp + 0x18]
push eax
mov dword [esi], ecx
lea ecx, [esp + 0x1b]
push ecx
push 0
push 0
mov bl, 1
push esi
push edx
mov byte [esi + 0x258], bl
mov byte [esp + 0x2f], bl
call fcn.0041b8f0
add esp, 0x1c
test al, al
mov ecx, esi
jne 0x41c525
call fcn.0041cc80
push esi
call fcn.0042bb52
add esp, 4
xor al, al
jmp 0x41c579
call fcn.0041cc80
push esi
call fcn.0042bb52
mov al, byte [esp + 0x17]
add esp, 4
test al, al
je 0x41c577
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..new
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x12c]
push str._s_s
push edx
call fcn.0042ba1b
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x138]
push ecx
call fcn.0042d341
add esp, 0x18
mov al, bl
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x21c]
pop ebx
xor ecx, esp
call fcn.0042baa4
add esp, 0x228
ret
Function at 0x420ae0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2cc
mov eax, dword [0x44b754]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x2d4]
push ebp
mov ebp, dword [esp + 0x2dc]
push esi
push edi
mov dword [esp + 0x2d8], eax
mov eax, dword [esp + 0x2e8]
push 0x3a
push ebp
mov esi, ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
call fcn.0042d650
add esp, 8
test eax, eax
jne 0x420b36
mov edi, dword [esi + 8]
cmp edi, 0xffffffff
je 0x420b36
mov ebx, dword [esi + 0xc]
jmp 0x420bf1
push 0x3a
push ebp
call fcn.0042d650
add esp, 8
test eax, eax
jne 0x420b7a
mov ecx, dword [esi]
push 0xfffffffffffffffa
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebp, dword [sym.imp.USER32.dll_LoadIconA]
mov ebx, eax
push 0xa8
push ebx
call ebp
mov edx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push 0xa9
push ebx
mov edi, eax
call ebp
push eax
jmp 0x420bc6
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x101
push 0x160
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
call ebp
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 4]
push edx
push 0xffffffffffffffff
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push 0x103
push 0x160
lea ecx, [esp + 0x180]
push ecx
push 0
push ebx
mov edi, eax
call ebp
mov edx, dword [esp + 0x178]
push edx
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, dword [esp + 0x10]
push 0x3a
push ecx
mov ebx, eax
call fcn.0042d650
mov ebp, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x420bf1
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov edx, dword [esp + 0x14]
push edx
push ebx
push edi
push ebp
mov ecx, esi
call fcn.00420940
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042baa4
add esp, 0x2cc
ret 0xc
Function at 0x421d50
Capabilities:
Get disk information

Disassembly:
sub esp, 0x244
mov eax, dword [0x44b754]
xor eax, esp
push ebx
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x24c]
push edi
push eax
mov edi, ecx
call fcn.004208e0
or eax, 0xffffffff
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
lea eax, [esp + 0x48]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x48]
xor ebx, ebx
test al, al
je 0x421e2f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
lea esi, [esp + 0x50]
push esi
call ebp
cmp eax, 3
jne 0x421e04
lea edx, [esp + 0x10]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x421db8
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.0042d650
add esp, 8
test eax, eax
je 0x421de7
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.0042d650
add esp, 8
mov byte [eax], 0
push 0xffff0000
lea eax, [esp + 0x14]
push eax
push esi
mov ecx, edi
call fcn.00420ae0
push 0
push eax
push esi
mov ecx, edi
call fcn.00421670
lea eax, [esp + 0x50]
lea edx, [eax + 1]
jmp 0x421e10
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421e10
sub eax, edx
lea ebx, [ebx + eax + 1]
mov al, byte [esp + ebx + 0x50]
test al, al
lea esi, [esp + ebx + 0x50]
jne 0x421da8
pop esi
pop ebp
mov ecx, dword [edi]
push 0xffff0000
push 1
push 0x1113
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x248]
mov eax, edi
pop edi
pop ebx
xor ecx, esp
call fcn.0042baa4
add esp, 0x244
ret 4

Function at 0x422310
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4223b6
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x422389
cmp word [ecx + 0xa], 4
jne 0x422389
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x422389
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.004222a0
test eax, eax
mov dword [esi], eax
je 0x4223aa
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x422360
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.0042d150
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4223c6.11001
jmp dword [eax*4 + 0x4223ec]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x422c20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x44b754]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [0x44ea24]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x422670
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x422960
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00422620
jne 0x422d82
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x422d78
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x422c90
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422ca6
mov edx, dword [str.ws2_32]
mov eax, dword [0x4405ec]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x422ced
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x422d3f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x422cf0
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422d05
mov edx, dword [str.wship6]
mov eax, dword [0x4405e4]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x422d74
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x422d3f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x422d74
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x422d36
inc edi
cmp edi, 3
jl 0x422d41
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x44b424], eax
mov dword [0x44b42c], ecx
mov dword [fcn.00422620], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x44ea24], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax*8 + 0x44b424]
xor ecx, esp
call fcn.0042baa4
add esp, 0x230
ret 4
Function at 0x426980
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x44b754]
xor eax, ebp
push ebx
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0x20], eax
cmp dword [esi], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
jg 0x4269e0
mov eax, dword [esp + 0x14]
xor edx, edx
div dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.0042baa4
mov esp, ebp
pop ebp
ret 8
xor edi, edi
lea esp, [esp]
mov byte [esp + 0x13], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.004266a0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x426b2d
push 0
mov dword [esp + 0x2c], edi
xor eax, eax
push 0
mov ecx, 0x19
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x48]
mov dword [esp + 0x44], eax
push 1
lea eax, [esp + 0x44]
push eax
push ebx
mov dword [esp + 0x4c], 0x64
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x426a6d
cmp dword [esp + 0x2c], 9
jne 0x426a6d
mov edi, str.pingcheck
lea esi, [esp + 0x38]
mov ecx, 0xa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x426a6d
mov byte [esp + 0x13], 1
jmp 0x426ae0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Read_error_:
push 0x44eb98
call fcn.00424260
add esp, 8
mov ecx, eax
call fcn.00424710
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00424880
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [eax + 8]
xor edi, edi
test cl, 6
jne 0x426abe
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x426abe
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x426ae0
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x426ad8
or eax, 4
push 0
push eax
call fcn.0042aaa3
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [esp + 0x13]
test al, al
je 0x426b07
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
sub eax, edx
add ecx, eax
mov dword [esp + 0x14], ecx
jmp 0x426b0f
add dword [esp + 0x14], 0x3e7
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
inc eax
cmp eax, edx
mov dword [esp + 0x1c], eax
mov esi, ecx
jl 0x4269d7
jmp 0x4269b8
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x3e7
pop ebx
call fcn.0042baa4
mov esp, ebp
pop ebp
ret 8
Function at 0x426c40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
mov dword [eax], edx
mov eax, dword [ecx]
mov dword [eax + 0x9c0], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x9c0]
cmp edx, 0x270
jge 0x426ca7
push esi
push edi
jmp 0x426c70
mov esi, dword [eax + 0x9c0]
lea eax, [eax + esi*4]
mov esi, dword [eax - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax], edi
mov eax, dword [ecx]
inc dword [eax + 0x9c0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x9c0]
cmp edx, 0x270
jl 0x426c70
pop edi
pop esi
ret 4

Function at 0x426cb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx]
mov eax, dword [eax + 0x9c0]
cmp eax, 0x270
jl 0x426da1
cmp eax, 0x271
jne 0x426cd4
push 0x1571
call fcn.00426c40
push ebx
push esi
xor edx, edx
push edi
lea esp, [esp]
mov esi, dword [ecx]
mov edi, dword [esi + edx*4]
mov eax, dword [esi + edx*4 + 4]
mov ebx, dword [esi + edx*4 + 0x634]
xor eax, edi
and eax, 0x7fffffff
xor eax, edi
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x44b454]
xor edi, ebx
shr eax, 1
xor edi, eax
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xe3
jl 0x426ce0
cmp edx, 0x26f
jge 0x426d5b
shl edx, 2
mov esi, dword [ecx]
mov edi, dword [edx + esi]
mov eax, dword [edx + esi + 4]
mov ebx, dword [edx + esi - 0x38c]
xor eax, edi
and eax, 0x7fffffff
xor eax, edi
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x44b454]
xor edi, ebx
shr eax, 1
xor edi, eax
mov dword [edx + esi], edi
add edx, 4
cmp edx, 0x9bc
jl 0x426d22
mov edx, dword [ecx]
mov ebx, dword [edx]
mov eax, dword [edx + 0x9bc]
mov esi, dword [edx + 0x9bc]
mov edi, dword [edx + 0x630]
xor eax, ebx
and eax, 0x7fffffff
xor eax, esi
mov esi, eax
and esi, 1
mov esi, dword [esi*4 + 0x44b454]
xor esi, edi
shr eax, 1
xor esi, eax
mov dword [edx + 0x9bc], esi
mov edx, dword [ecx]
pop edi
pop esi
mov dword [edx + 0x9c0], 0
pop ebx
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x427557
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x34]
sub edi, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x24]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x4275e4
mov eax, dword [esi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0042e1b0
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
add esp, 0xc
sub dword [esi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4275a4
mov eax, dword [esi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4275c6
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4276a2
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x42760c
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x427617
xor eax, eax
jmp 0x427663
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x427634
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.0041cd40
jmp 0x427644
cmp ecx, 2
jne 0x42764d
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00429a5a
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0042e1b0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x42768e
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x4276a2
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x427562
pop edi
pop ebx
leave
ret
Function at 0x429dc8
Capabilities:
Decompress data using ucl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor edx, edx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 8]
test al, 0x7f
je 0x429ded
add eax, eax
jmp 0x429df6
movzx eax, byte [edx + esi]
lea eax, [eax + eax + 1]
inc edx
mov edi, 0x100
test edi, eax
je 0x429e11
mov cl, byte [edx + esi]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0x10]
inc dword [ebp - 8]
mov byte [ebx + edi], cl
inc edx
jmp 0x429de5
xor ecx, ecx
mov dword [ebp - 4], edx
inc ecx
test al, 0x7f
je 0x429e1f
add eax, eax
jmp 0x429e28
movzx eax, byte [edx + esi]
lea eax, [eax + eax + 1]
inc edx
mov ebx, eax
shr ebx, 8
and ebx, 1
test al, 0x7f
lea ecx, [ebx + ecx*2]
je 0x429e3c
lea ebx, [eax + eax]
jmp 0x429e45
movzx ebx, byte [edx + esi]
lea ebx, [ebx + ebx + 1]
inc edx
test edi, ebx
jne 0x429e6a
test bl, 0x7f
je 0x429e53
lea eax, [ebx + ebx]
jmp 0x429e5c
movzx eax, byte [edx + esi]
lea eax, [eax + eax + 1]
inc edx
mov ebx, eax
shr ebx, 8
and ebx, 1
lea ecx, [ebx + ecx*2 - 2]
jmp 0x429e17
cmp ecx, 2
mov dword [ebp - 4], edx
jne 0x429e94
test bl, 0x7f
mov edi, dword [ebp - 0xc]
je 0x429e7e
add ebx, ebx
jmp 0x429e8a
movzx ebx, byte [edx + esi]
inc edx
lea ebx, [ebx + ebx + 1]
mov dword [ebp - 4], edx
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x429ebc
movzx eax, byte [edx + esi]
add ecx, 0xfffffffd
shl ecx, 8
add eax, ecx
inc edx
cmp eax, 0xffffffff
mov dword [ebp - 4], edx
je 0x429f8a
mov ecx, eax
not ecx
shr eax, 1
and ecx, 1
inc eax
mov edi, eax
mov dword [ebp - 0xc], edi
test ecx, ecx
je 0x429ee1
test bl, 0x7f
je 0x429eca
lea eax, [ebx + ebx]
jmp 0x429ed6
movzx eax, byte [edx + esi]
inc edx
lea eax, [eax + eax + 1]
mov dword [ebp - 4], edx
mov ecx, eax
shr ecx, 8
and ecx, 1
inc ecx
jmp 0x429f55
test bl, 0x7f
je 0x429eeb
lea eax, [ebx + ebx]
jmp 0x429ef7
movzx eax, byte [edx + esi]
inc edx
lea eax, [eax + eax + 1]
mov dword [ebp - 4], edx
test ah, 1
je 0x429f1a
test al, 0x7f
je 0x429f04
add eax, eax
jmp 0x429f10
movzx eax, byte [edx + esi]
inc edx
lea eax, [eax + eax + 1]
mov dword [ebp - 4], edx
mov ecx, eax
shr ecx, 8
and ecx, 1
jmp 0x429f52
xor ecx, ecx
inc ecx
test al, 0x7f
je 0x429f25
add eax, eax
jmp 0x429f2e
movzx eax, byte [edx + esi]
lea eax, [eax + eax + 1]
inc edx
mov ebx, eax
shr ebx, 8
and ebx, 1
test al, 0x7f
lea ecx, [ebx + ecx*2]
je 0x429f41
add eax, eax
jmp 0x429f4a
movzx eax, byte [edx + esi]
lea eax, [eax + eax + 1]
inc edx
test ah, 1
je 0x429f1d
mov dword [ebp - 4], edx
add ecx, 3
mov edx, 0x500
cmp edx, edi
sbb edx, edx
neg edx
add ecx, edx
mov edx, dword [ebp - 8]
mov esi, edx
sub esi, edi
mov edi, dword [ebp + 0x10]
add esi, edi
mov bl, byte [esi]
mov byte [edx + edi], bl
inc edx
inc esi
mov bl, byte [esi]
mov byte [edx + edi], bl
inc edx
inc esi
dec ecx
jne 0x429f75
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
jmp 0x429de2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, edx
sub eax, dword [ebp + 0xc]
cmp edx, dword [ebp + 0xc]
pop edi
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 0xffffff37
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
leave
ret
Function at 0x42ccb3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x42ccd0
call fcn.0042fb45
mov dword [eax], 0x16
xor eax, eax
jmp 0x42cd3a
push esi
push 0x8c
push 1
call fcn.0042dbd9
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x42cd25
push esi
call fcn.00431626
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x42cd03
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x42cc1e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42cd39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042d36f
test ebx, ebx
pop ecx
je 0x42cd37
push ebx
call fcn.0042fb57
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42d88b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42d8ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042fb57
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x42d8ce
test byte [esp + 8], 2
je 0x42d8ce
call fcn.0042fb45
mov dword [eax], 0xd
call fcn.0042fb4e
mov dword [eax], 5
jmp 0x42d8a7
xor eax, eax
ret
Function at 0x42dfcf
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4439b8
call fcn.0042f9f0
mov edi, 0x94
mov eax, edi
call fcn.0042bb10
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x44edd8], ecx
mov eax, dword [esi + 4]
mov dword [0x44ede4], eax
mov edx, dword [esi + 8]
mov dword [0x44ede8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44eddc], esi
cmp ecx, 2
je 0x42e02f
or esi, 0x8000
mov dword [0x44eddc], esi
shl eax, 8
add eax, edx
mov dword [0x44ede0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x42e06a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e06a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42e082
cmp eax, 0x20b
je 0x42e06f
mov dword [ebp - 0x1c], esi
jmp 0x42e096
cmp dword [ecx + 0x84], 0xe
jbe 0x42e06a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x42e090
cmp dword [ecx + 0x74], 0xe
jbe 0x42e06a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004343cb
pop ecx
test eax, eax
jne 0x42e0aa
push 0x1c
call fcn.0042dfab
pop ecx
call fcn.00431820
test eax, eax
jne 0x42e0bb
push 0x10
call fcn.0042dfab
pop ecx
call fcn.00435ab7
mov dword [ebp - 4], esi
call fcn.00434f3f
test eax, eax
jge 0x42e0d4
push 0x1b
call fcn.0042df86
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4504b4], eax
call fcn.00435995
mov dword [0x44ec40], eax
call fcn.004358f3
test eax, eax
jge 0x42e0fa
push 8
call fcn.0042df86
pop ecx
call fcn.004356c0
test eax, eax
jge 0x42e10b
push 9
call fcn.0042df86
pop ecx
push 1
call fcn.00432884
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x42e121
push eax
call fcn.0042df86
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00435663
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x42e142
movzx eax, word [ebp - 0x40]
jmp 0x42e145
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401000
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x42e163
push edi
call fcn.004329b1
call fcn.004329d3
jmp 0x42e195
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0042fa2b
ret