joyce8/EMBER2024-capa huggingface dataset:
Function at 0x280f972
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
jg 0x2819f60
stosb byte es:[edi], al
push esp
mov bl, 2
lea esp, [esp + 4]
call fcn.01554cd1
aas
sbb dword [0x1530ea01], edx
add dword [ebp + 0x11527], ebp
add byte [eax], al
add dh, dh
std
adc al, 1
add byte [eax], al
add byte [eax], al
mov dword [ecx], esi
adc eax, 1
add byte [0x2415e], bh
add byte [eax], al
add ah, bh
mov dword [ecx + 2], 0
mov edi, ebx
inc ecx
add al, byte [eax]
add byte [eax], al
add byte [edi + 0x1154b], bl
add byte [eax], al
add byte [ebx], cl
adc dword [ecx + 2], eax
xor ch, byte [edx]
cmp eax, 0x416f8501
add al, byte [eax + 0x23]
cmp eax, 0x41532701
add ah, byte [ecx + 0x2417e]
add byte [eax], al
add cl, ah
rcl dword [ecx + 0x5d], cl
push ebx
or edi, ebp
xchg edx, eax
jge 0x2819f7d
shl byte [ebx + 0x27], 0x80
invalid

Function at 0x280fd11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
jbe 0x281de84
mov cx, 0xa284
shrd di, sp, cl
or ecx, 0x82a51aff
mov edi, dword [edx + 0x24]
xchg cx, bx
shr bx, 0xd
movsx cx, al
add edi, eax
jmp 0x1550ff2
mov dword [esp + 4], edx
push eax
jmp 0x1553c76
push ds
dec ebx
and ebx, dword [ebx]
std
and dword [edi - 0x23], 0xe531bba2
mov bh, 0xbc
or eax, edi
sal edx, 0xef
adc ah, dh
test dword [ebx - 0x3f], edi
cmp eax, 0x21091d11
inc eax
bound edx, qword [edi + 0x225234ad]
and ah, byte [edx]
push esi
lodsb al, byte [esi]
popfd
ret
push 0x58f6c74b
cmp edx, 0x72bec5a9
push ebx
cmc
sub ecx, dword [edx + 0x10]
cmc
mov word [esp], 0xed23
cmp dh, 0x3d
cmp ecx, dword [edx + 0x14]
push 0x93008ff5
mov byte [esp + 4], 0x66
call fcn.015512df
jecxz 0x281de46
pop esi
enter 0xffffffffffff98bb, 0x50
mov esp, 0x97a69bd0
fisub dword [ecx + 0x4b02ef78]
dec esi
and eax, 0x51743524
test al, 0xcd
cmp al, 0x93
adc eax, 0xef07de93
push edx
inc eax
push es
dec eax
or dword [0xbc65fabf], ebx
movsd dword es:[edi], dword [esi]
aam 0xf6
out 0x6e, al
rcl byte [edx], 0xa5
jb 0x281ded4
jno 0x281dee5
fsubr qword [ebx - 0x32]
pop ds
shl dword [edi - 0x64d670a], 1
cmp al, 0xfc
dec esp
xor edi, esp
invalid
Function at 0x281dbc1
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x68bf22a2]
cmc
in eax, dx
ja 0x17d2b39
iretd
call 0x2812ef4
jo 0x17d2b15
dec esi
dec edi
push ebx
movsb byte es:[edi], byte [esi]
add dh, byte [ebx]
scasb al, byte es:[edi]
rol esi, cl
and esp, dword [esi]
jp 0x4de329de
daa
and dl, byte [edi]
pop ss
mov ch, bl
push ss
dec ebx
outsb dx, byte [esi]
jae 0x17d2ac3
wait
push ds
dec edi
jns 0x17d2b84
inc byte [edi - 5]
ror ecx, 0xc7
sub byte [0xb995e18c], ah
dec ebp
test dh, ch
xor byte [ebx + ebx], 0xa4
xor al, 0x1b
movsb byte es:[edi], byte [esi]
mov word [eax + 0x2a87b612], ss
xchg dword [edx], ebp
popfd
pop esi
and dword [edi], eax
or byte [edx + 0x75], dl
movsd dword es:[edi], dword [esi]
sal dword [edi], 0x54
fstp dword [edi + 0x2c3d54f3]
add eax, 0xe242f963
push cs
push esp
cmp eax, 0xf963052c
inc edx
loop 0x17d2b61
sub byte [ecx], dh
jb 0x17d2b32
lodsb al, byte [esi]
retf
shr eax, 1
loop 0x17d2b19
mov eax, 0x5c30eef0
jecxz 0x17d2b49
stosd dword es:[edi], eax
in eax, dx
sub al, 0xd9
xchg dword [edx + eax*4 + 0x3f0423e8], esp
sbb dword [edx], ecx
dec edi
ror dword [0x2a520b37], cl
sbb eax, 0xca75584b
jne 0x17d2b50
jns 0x17d2bdd
pushfd
push eax
push esi
cli
stc
and eax, 0xcc894874
mov ebx, 0xda0ac3be
add dh, byte [edx - 0x55555546]
sar byte [edi], cl
pop ebp
push ebx
fist dword [ebx + 0x4b4dd9a3]
iretd
sahf
jne 0x17d2c1d
cmc
or dword [esp + edx*8 + 0x5e], 0x81c603fa
jne 0x17d2c64
dec ebp
in al, 0x57
sbb eax, 0x609b1462
jbe 0x17d2c0d
xchg ebp, eax
invalid
push 0x5c
leave
aaa
pop ecx
fisub dword [ebp + 0x12]
lcall 0xfb2a, 0x840980be
mov ebx, 0xc531284f
mov dl, 0xa7
mov byte [0x4bf89e7a], al
dec edi
sub byte [ecx], dh
lds esi, [edx - 0x61855d59]
clc
dec ebx
test ch, ah
sbb dword [ebp - 0x51], ecx
lahf
fmul qword [esi]
xor byte [ebp - 0x2a955304], dh
call dword [ebx]
pushfd
inc edx
adc eax, dword [eax - 0x11]
bound esp, qword [ecx]
and al, 0xd8
or al, 0xee
ficomp word [ecx - 0x687a952f]
mov edi, 0xb3096261
pop eax
jle 0x17d2c59
lodsb al, byte [esi]
shl dword [ebx - 0x2f], 1
mov al, byte [0xe488fe3a]
xchg ebx, eax
in al, 0x93
lds ebx, [edx*2 - 0x78305e73]
mov bl, 0x4b
push ebx
sbb dword [0x1a18d9b9], esp
add bl, byte [edx]
push edi
test dword [ecx], esi
add dword gs:[0xece374d1], edx
aaa
das
daa
imul esp, esp, 0x9599910d
movsd dword es:[edi], dword [esi]
clc
test edi, edi
mov byte [esp], al
lea esp, [esp + 4]
je 0x28165db
clc
jmp 0x17d2af9

Function at 0x281e0af
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov word [esp + 0xc], 0xdaf1
lea esp, [esp + 0x2c]
jae 0x281c8e2
call fcn.0281e964
xchg ebp, eax
pop edx
mov word [edx], ds
test dword [eax - 0x43591b0], ebx
push bx
push ds
lds ebp, [edi + edi*4]
cli
idiv dword [edx]
sub edi, dword [esi + 0x563bb819]
xchg dword [edx - 0x1f], ebp
xor edi, ebp
vsqrtps xmm3, xmmword [edi - 0x12]
push ecx
cli
cli
sub byte [edx], bh
cmp byte es:[esi - 0x37], dh
scasb al, byte es:[edi]
push ds
xor ecx, esi
push es
sti
aam 0xd8
jne 0x281e0c6
test eax, ebx
hlt
Function at 0x281ecc7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.02816f76
jnp 0x1551430
xor byte [esi - 0x1acb38a], ah
fnstenv [esi + 3]
in al, 0xc5
lcall 0x5a2e, 0x8ee1c007
push cs
shr dl, 1
salc
sbb eax, dword [ebx - 0x758915aa]
iretd
adc dword [ecx*4 - 0x6a231a0c], esi
pop esi
imul eax, dword [esi - 0x76827675], 0x6d
adc dword [ebp + 0x75], 0xca983929
or byte [eax], al
test al, 0x15
lea edi, [edx]
bound esp, qword [ebx + 0x63]
arpl word [eax], cx
push edx
adc eax, 0xa7acd971
jae 0x1551416
ljmp 0x470a:0xaccf09be
push 0x19ea0007
mov word [esp + 4], 0x4c85
lea esp, [esp + 0x30]
je 0x27fbb31
test ch, cl
cmp ch, 0xfa
sub al, 0x30
bt ebp, ebx
test dh, bh
cmp al, 9
jmp 0x15513db
Function at 0x4038fe
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x403a8a
Capabilities:
Create directory

Disassembly:
mov eax, 0x428cc0
call fcn.00427a40
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403aad
mov al, 1
jmp 0x403af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403abe
xor al, al
jmp 0x403af3
lea ecx, [ebp - 0x44]
call fcn.00403c38
lea ecx, [ebp - 0x1c]
call fcn.004025e2
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00403eef
test al, al
je 0x403ae8
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00402103
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x403ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403eee
or eax, eax
ret

Function at 0x404552
Capabilities:
Get disk information

Disassembly:
mov eax, 0x428d70
call fcn.00427a40
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00401edc
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x404620
mov eax, SysReAllocString
cmp ebx, eax
ja 0x40458e
mov eax, ebx
add eax, eax
push eax
call fcn.004020dc
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x404619
cmp ebx, dword [ebp - 0x14]
ja 0x404619
lea ecx, [ebp - 0x2c]
call fcn.004025e2
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x404601
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4045f6
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402721
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00401a86
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x4045cc
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00402103
push esi
call fcn.00402103
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x404622
push esi
call fcn.00402103
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4046a7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4046cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4046cd
xor al, al
jmp 0x4046ed
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00427d20
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40d0b3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42970e
call fcn.00427a40
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004025e2
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040d102
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40d15f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x429759
call fcn.00427a40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040f587
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040d1aa
push dword [esi + 0x24]
call fcn.00402103
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00411d8b
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040d6da
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4107e1
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x42c7a8
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret

Function at 0x4117e7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x429ec8
call fcn.00427a40
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42d024
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.004025e2
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025e2
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.004025e2
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004025e2
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.004025e2
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42cfe8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4117f3
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x429ec8
call fcn.00427a40
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42d024
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.004025e2
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025e2
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.004025e2
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004025e2
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.004025e2
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42cfe8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x411cbf
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x429fbe
call fcn.00427a40
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x42d024
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.004025e2
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e2
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e2
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x42d094
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x411d21
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x429ff1
call fcn.00427a40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00411d8b
push dword [esi + 0x24]
call fcn.00402103
push dword [esi + 0x18]
call fcn.00402103
push dword [esi + 0xc]
call fcn.00402103
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x42d05c
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x4131ea
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x42a284
call fcn.00427a40
sub esp, 0x320
push ebx
mov dword [ebp - 0x1c], ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.004025e2
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [esi], 0
je 0x413257
push dword [esi + 0xc]
lea ecx, [ebp - 0x40]
push dword [esi + 8]
call fcn.004130a6
push eax
mov edx, 0xdb0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00413146
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00402785
push dword [ebp - 0x58]
call fcn.00402103
push dword [ebp - 0x40]
and byte [ebp - 4], 0
call fcn.00402103
pop ecx
pop ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.00402a7a
lea ebx, [eax + 1]
lea eax, [ebp - 0x4c]
push ebx
push eax
mov ecx, edi
call fcn.00408516
mov eax, dword [edi]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
lea eax, [eax + ebx*2]
push eax
call fcn.00402625
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x4c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.0041318c
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.0041318c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x18]
push eax
call fcn.004026b5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004028f7
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040296a
lea ecx, [ebp - 0x18]
call fcn.004028f7
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040296a
lea ecx, [ebp - 0x18]
call fcn.004028f7
cmp byte [esi + 1], 0
je 0x413333
mov edx, 0x3f4
lea ecx, [ebp - 0x40]
call fcn.0040557c
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.0040296a
push dword [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00402103
lea ecx, [ebp - 0x18]
mov dword [esp], 0x42d154
call fcn.004029a6
push 0
lea edx, [ebp - 0x78]
lea ecx, [esi + 0x10]
call fcn.0040537b
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x18]
push eax
call fcn.004029a6
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi]
push 0x110
lea eax, [ebp - 0x32c]
push 0x2b4
push eax
push 0x80
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x41338a
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x32c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.00402103
push dword [ebp - 0x34]
call fcn.00402103
push dword [ebp - 0x4c]
call fcn.00402103
push dword [ebp - 0x28]
call fcn.00402103
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x413561
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x42a2bc
call fcn.00427a40
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.004025e2
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004025e2
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.004025e2
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.004135f7
lea ecx, [esi + 0x9c]
call fcn.004267e0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x415000
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x42a550
call fcn.00427a40
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.00413bdd
push 1
mov ecx, esi
call fcn.0041454e
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.004103fc
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.00402103
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
lea ecx, [ebp - 0x50]
call fcn.00415196
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00415196
lea eax, [esi + 0x1f4]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1bc], ebx
lea ebx, [esi + 0x1c4]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.004151c7
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.004151c7
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x41511a
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x213], 1
jne 0x415110
push 0x42d27c
lea ecx, [ebp - 0x50]
call fcn.00402883
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x415145
cmp byte [ebp - 0xd], 0
jne 0x41515b
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x213], 1
je 0x415174
cmp dword [ebp - 0x34], ebx
jne 0x41513e
push 0x42d27c
lea ecx, [ebp - 0x38]
call fcn.00402883
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x415174
cmp byte [esi + 0x146], 0
jne 0x415174
mov ecx, esi
mov byte [esi + 0x145], 1
call fcn.0041556d
jmp 0x41517d
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.00413a8a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x415b88
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x420aa0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x3e4
push ebp
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x420ace
cmp dword [esp + 0xc], 6
jne 0x420ace
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420af8
push str.SetDefaultDllDirectories
push 0x42c6ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420af8
push 0xc00
call eax
test eax, eax
jne 0x420bae
lea ecx, [esp + 0x11c]
push 0x106
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x420bae
cmp eax, 0x104
ja 0x420bae
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
cmp word [esp + ebp*2 + 0x11a], 0x5c
je 0x420b44
mov word [esp + ebp*2 + 0x11c], 0x5c
inc ebp
mov esi, dword [str.UXTHEME]
cmp byte [esi], 0
je 0x420bae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov al, byte [esi]
xor cx, cx
inc esi
mov cl, al
test al, al
mov word [esp + ebp*2 + 0x124], cx
je 0x420b8a
lea ecx, [esp + ebp*2 + 0x126]
mov al, byte [esi]
xor dx, dx
mov dl, al
inc esi
mov word [ecx], dx
add ecx, 2
test al, al
jne 0x420b78
lea eax, [esp + 0x124]
push str..dll
push eax
call edi
lea ecx, [esp + 0x124]
push 8
push 0
push ecx
call ebx
cmp byte [esi], 0
jne 0x420b5d
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x3e4
ret
Function at 0x4243b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x42441b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x42445c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x424441
mov ecx, ebx
call fcn.004240a0
add ebx, 0x28
dec ebp
jne 0x424435
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x424457
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00423fd0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.00424500
mov ebx, eax
cmp ebx, edi
jne 0x4244bf
lea ecx, [ebp + 0x20]
call fcn.00426680
mov ebx, eax
cmp ebx, edi
jne 0x4244bf
lea ecx, [ebp + 0x1c]
call fcn.00426680
mov ebx, eax
cmp ebx, edi
jne 0x4244bf
push ebp
call fcn.00424550
mov ebx, eax
cmp ebx, edi
je 0x4244d4
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.00424530
cmp ebx, edi
jle 0x4244cf
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x4244d4
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x4244e6
cmp dword [esi + 0x40], edi
jne 0x4244e6
cmp dword [esi + 0x3c], edi
jne 0x4244e6
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret