joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40392f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
cmp dword [ebp + 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x403b05
cmp dword [ebp + 0xc], ebx
je 0x403b05
push esi
push 0x406c18
lea eax, [ebp - 0x11c]
push 0xff
push eax
push 0x406e20
mov edi, 0x40611c
push str.toolbar_image
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x11c], bl
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
je 0x403a3e
push 0x2050
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push ebx
mov byte [0x406d1e], 1
call dword [sym.imp.USER32.dll_LoadImageA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4039f8
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [ebp - 0x14], 0xa
jl 0x4039f8
mov eax, dword [ebp - 0x18]
push 7
cdq
pop ecx
idiv ecx
cmp eax, 0xa
jl 0x4039f8
push ebx
call esi
cmp dword [ebp - 0x18], eax
jle 0x403a39
mov eax, dword [0x406a00]
or eax, 0x12030
push eax
lea eax, [ebp - 0x11c]
push eax
push 0x406734
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x406c18
push ebx
push str.toolbar_image
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 4], ebx
je 0x403a3e
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jne 0x403a5e
push ebx
push ebx
push ebx
push ebx
push 0xfa2
push ebx
mov byte [0x406d1e], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 4], eax
mov eax, dword [0x4069e8]
cmp eax, ebx
je 0x403a6e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 4]
mov dword [0x4069e8], eax
mov eax, dword [0x4069ec]
cmp eax, ebx
je 0x403a86
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push dword [0x4069e8]
call fcn.00403842
pop ecx
mov dword [0x4069ec], eax
pop ecx
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [0x4069e8]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x18]
push 7
cdq
pop ecx
idiv ecx
push ecx
mov dword [0x406010], eax
mov eax, dword [ebp - 0x14]
mov dword [0x406014], eax
call esi
mov edi, eax
push 4
movzx eax, byte [0x406040]
add edi, eax
call esi
mov ecx, dword [0x406014]
push 7
add ecx, eax
lea eax, [ecx + edi*2]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
movzx edi, byte [0x406040]
call esi
mov ecx, eax
mov eax, dword [0x406010]
add eax, edi
pop esi
lea eax, [eax + eax*2]
add ecx, eax
lea eax, [edi + ecx*2]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop ebx
leave
ret
Function at 0x407510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407532
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407528
mov eax, 1
add ebx, ebx
jne 0x40754b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407540
jne 0x40755c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407540
xor ecx, ecx
sub eax, 3
jb 0x407570
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4075e2
mov ebp, eax
add ebx, ebx
jne 0x40757b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4075ac
inc ecx
add ebx, ebx
jne 0x407598
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40758d
jne 0x4075a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40758d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4075cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4075bd
jmp 0x40752e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4075cc
add edi, ecx
jmp 0x40752e
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x40762b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x71dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7218]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4075e9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7220]
or eax, eax
je 0x407625
mov dword [ebx], eax
add ebx, 4
jmp 0x407606
call dword [esi + 0x721c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40765c
cmp al, 0xef
ja 0x40764f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x407631
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40763e
mov ebp, dword [esi + 0x7224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407690
sub esp, 0xffffff80
jmp 0x4018b0
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7be5d0d1
mov ebx, 0x284ef8ef
xor ebx, eax
mov ecx, 0x79b1a58d
xor ebx, ecx
xor ebx, 0x6d7e8637
mov edi, 0x39a78f38
xor edi, 0x7bf4cf98
mov ecx, 0
mov eax, 0x2804880a
xor ecx, eax
xor edi, ecx
xor edi, ebx
mov eax, 0xb079ba1
xor eax, 0xb474a21
lock and dword [edx + 0x47], ecx
or ecx, dword [ecx - 0xf117c3a]
mov esi, 0x7ea8d6fb
xor esi, 0x30ab3c3e
push esi
mov esi, 0x3b611f1b
mov ecx, 0x7562f5de
xor ecx, esi
pop edx
xor ecx, edx
xor ecx, ecx
jmp 0x403faa

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x404011
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x44
mov eax, 0x4932dd
call fcn.0042e948
mov edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040c092
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040c092
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 3
call dword [eax + 4]
mov dword [edi + 0x32c], eax
jmp 0x40406d
mov eax, dword [edi + 0x32c]
mov dword [ebp - 4], 2
cmp eax, 0x80004004
je 0x4040bd
cmp dword [ebp - 0x34], 0
jne 0x4040bd
test eax, eax
je 0x4040bd
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00403f9f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.0040c0b6
push dword [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0042e9b9
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040c0b6
lea eax, [edi + 0x2ac]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00403ebe
xor esi, esi
pop ecx
pop ecx
cmp dword [edi + 0x298], esi
jbe 0x4040fb
cmp esi, 0x20
jae 0x4040fb
mov eax, dword [edi + 0x294]
push dword [eax + esi*4]
lea eax, [ebp - 0x38]
push eax
call fcn.00403ebe
inc esi
pop ecx
pop ecx
cmp esi, dword [edi + 0x298]
jb 0x4040d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp eax, 0x3e8
ja 0x404125
cmp byte [edi + 0x328], 0
jne 0x40411a
cmp dword [ebp - 0x40], 0
je 0x404125
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [edi + 0x14c]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2e8]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0xb8]
call fcn.00403ee8
mov ecx, edi
call fcn.00402f51
cmp dword [ebp - 0x34], 0
jne 0x4041fb
cmp dword [edi + 0x2d4], 0
je 0x4042ba
lea eax, [edi + 0x2c4]
push eax
lea ecx, [edi + 0xdc]
call fcn.00403e8e
jmp 0x4042ba
lea ecx, [ebp - 0x50]
call fcn.0040c092
xor ebx, ebx
mov byte [ebp - 4], 8
cmp dword [edi + 0xa4], ebx
jbe 0x40422b
mov eax, dword [edi + 0xa0]
lea ecx, [ebp - 0x50]
push dword [eax + ebx*4]
call fcn.0040c25a
inc ebx
cmp ebx, dword [edi + 0xa4]
jb 0x404211
cmp dword [ebp - 0x4c], 0
lea ebx, [edi + 0xc4]
mov ecx, ebx
lea eax, [ebp - 0x44]
je 0x40423f
lea eax, [ebp - 0x50]
push eax
call fcn.0040c0b6
cmp dword [edi + 0x298], 0
jbe 0x40428a
lea eax, [edi + 0x2ac]
mov ecx, ebx
push eax
call fcn.0040c25a
push 0x49ab24
mov ecx, ebx
call fcn.0040c2e7
mov eax, dword [edi + 0x294]
mov ecx, ebx
push dword [eax]
call fcn.0040c25a
mov eax, dword [edi + 0x294]
lea ecx, [edi + 0xd0]
push dword [eax]
call fcn.0040c0b6
cmp dword [edi + 0xc8], 0
jne 0x40429e
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0040c0b6
cmp dword [edi + 0x32c], 0
jne 0x4042b1
mov dword [edi + 0x32c], 0x80004005
push dword [ebp - 0x50]
call fcn.0042e9b9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x44]
call fcn.0042e9b9
push dword [ebp - 0x38]
call fcn.0042e9b9
pop ecx
pop ecx
mov ecx, edi
mov dword [ebp - 4], 9
call fcn.00402f1a
call fcn.0042e8a6
ret
Function at 0x4046f1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x404727
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x40471a
cmp esi, ecx
jae 0x40480a
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x4047a0
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x49ac48]
xor ecx, eax
or ecx, edx
jmp 0x4047f0
cmp edi, 6
jbe 0x4047f0
cmp edx, 4
jne 0x4047f0
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x404739
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405c3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x405c58
xor eax, eax
jmp 0x405d75
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [eax - 4]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x405c73
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x405c77
inc esi
cmp esi, ecx
jb 0x405c6a
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x405d62
cmp ecx, 2
jbe 0x405ccd
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x405d53
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x405cf9
add ebx, eax
jmp 0x405cfb
shr edx, cl
test edx, edx
je 0x405c91
cmp edx, 4
ja 0x405ceb
cmp edx, 3
je 0x405ceb
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x405c91
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x405c65
sub ebx, eax
test edx, edx
je 0x405d30
and edx, 6
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x405d2e
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x405d2c
add ebx, eax
jmp 0x405d2e
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
pop eax
jmp 0x405d5b
or edx, 8
xor eax, eax
shr edx, 1
inc eax
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x405cf1
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
pop ebp
ret

Function at 0x405e64
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4c4290]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405ebf
cmp dword [ebp - 0x114], 5
sbb eax, eax
add eax, 1
je 0x405ebf
lea eax, [ebp - 0x13c]
push eax
call fcn.00405fbc
pop ecx
test eax, eax
je 0x405ebf
mov eax, dword [ebp - 0x124]
shr eax, 0x19
and eax, 1
jmp 0x405ec1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e895
mov esp, ebp
pop ebp
ret
Function at 0x406178
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x4c4290]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3e8], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4061b8
cmp dword [ebp - 0x3e4], 6
jne 0x4061b8
cmp dword [ebp - 0x3e0], 0
je 0x4061e2
push str.SetDefaultDllDirectories
push 0x49ab28
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4061e2
push 0xc00
call eax
test eax, eax
jne 0x40627c
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40627c
cmp eax, 0x104
ja 0x40627c
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x406226
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [0x49ac98], 0
push esi
mov esi, 0x49ac98
je 0x40627b
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movsx ax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x406241
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x40623f
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e895
mov esp, ebp
pop ebp
ret
Function at 0x4093f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x4094a0
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x40947f
push edi
call fcn.004093c8
pop ecx
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x409471
cmp dword [esi + 0x5c], ebx
je 0x40949b
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
pop ecx
pop ecx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.004098b7
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.0040938a
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x409522
lea eax, [ebx + 0x20]
push eax
call fcn.0040b9e6
mov edi, eax
pop ecx
test edi, edi
jne 0x409522
lea eax, [ebx + 0x1c]
push eax
call fcn.0040b9e6
mov edi, eax
pop ecx
test edi, edi
jne 0x409522
push ebx
call fcn.0040a28f
mov edi, eax
test edi, edi
je 0x409522
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.004092fc
add ebx, 0x28
pop ecx
sub esi, 1
jne 0x409510
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x409536
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x40954a
cmp dword [esi + 0x40], edx
jne 0x40954a
cmp dword [esi + 0x3c], edx
jne 0x40954a
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret

Function at 0x40b67d
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret
Function at 0x40ba5f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.0047947f
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x40ba8b
call fcn.0040ba02
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d9dd
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x4934f1
call fcn.0042e8dd
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40d9fd
mov al, 1
jmp 0x40da44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40da0e
xor al, al
jmp 0x40da44
lea ecx, [ebp - 0x44]
call fcn.0040dc38
lea ecx, [ebp - 0x1c]
call fcn.0040c092
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040dcd0
test al, al
je 0x40da39
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0042e9b9
pop ecx
mov al, bl
call fcn.0042e8a6
ret

Function at 0x40dbab
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x40e1f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x40e29c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e2c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40e2c2
xor al, al
jmp 0x40e2d6
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40e5ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c4290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.0040c191
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0042e895
mov esp, ebp
pop ebp
ret
Function at 0x40f3cd
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4c4290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str.GlobalMemoryStatusEx
push 0x49ab28
mov dword [ebp - 0x64], 0x40
and dword [esi + 4], 0
mov dword [esi], SysReAllocString
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f430
lea ecx, [ebp - 0x64]
push ecx
call eax
test eax, eax
je 0x40f430
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.0040f350
add esp, 0x10
mov dword [esi + 4], edx
jmp 0x40f44f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], eax
cmovb eax, dword [ebp - 0xc]
and dword [esi + 4], 0
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.0042e895
mov esp, ebp
pop ebp
ret
Function at 0x417734
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x417742
and dword [esi], 0
mov eax, dword [ebp + 0x10]
xor edx, edx
inc edx
test eax, eax
je 0x417784
push 0
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp + 0x14]
add dword [ecx + 8], eax
adc dword [ecx + 0xc], 0
test esi, esi
je 0x417784
add dword [esi], eax
test edx, edx
setne al
movzx eax, al
push eax
call fcn.0041727f
pop ecx
pop esi
pop ebp
ret 0x10

Function at 0x41e208
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49642c
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4c4290]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00421ff5
lea ecx, [esi + 0x30]
call fcn.0041e1ae
push dword [esi + 0x24]
call fcn.0042e9b9
pop ecx
lea ecx, [esi + 0xc]
call fcn.00402bb1
mov ecx, esi
call fcn.0041e0c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret