joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c51
Capabilities:
Get disk size

Disassembly:
push 0xdc
mov eax, 0x437b23
call fcn.00427d33
mov ebx, ecx
xor eax, eax
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x94], edi
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], edi
cmp dword [ecx + 0x14], 8
jb 0x404c91
mov edx, dword [ecx]
jmp 0x404c93
mov edx, ecx
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea eax, [edx + eax*2]
jb 0x404ca1
mov ecx, dword [ecx]
push eax
push ecx
push 0x5c
lea edx, [ebp - 0x9c]
pop ecx
call fcn.00405224
mov edx, dword [ebp - 0x98]
pop ecx
pop ecx
lea ecx, [ebx + 0x27c]
add edx, 0xffffffe8
mov eax, dword [ecx]
push edx
call dword [eax + 0x8c]
mov edx, 0x441a24
lea ecx, [ebp - 0xb4]
call fcn.00412f4b
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 1
cmp dword [ebp - 0xa0], 8
lea eax, [ebp - 0xb4]
push ecx
cmovae eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x404da4
push 0x80
lea eax, [ebp - 0x90]
push edi
push eax
call fcn.00429320
add esp, 0xc
lea eax, [ebp - 0x90]
push 0x3f
push eax
push dword [ebp - 0xe4]
push dword [ebp - 0xe8]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
push eax
lea ecx, [ebp - 0xd8]
call fcn.00401590
lea esi, [ebx + 0x204]
mov byte [ebp - 4], 2
mov eax, dword [esi]
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, esi
call dword [eax + 0x8c]
push 1
mov ecx, esi
call fcn.004141dc
mov eax, dword [ebp - 0xe8]
mov ecx, ebx
mov dword [ebx + 0x758], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebx + 0x75c], eax
call fcn.00405015
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.004017dc
push edi
push 1
lea ecx, [ebp - 0xb4]
call fcn.004017dc
lea ecx, [ebp - 0x9c]
call fcn.004050a9
call fcn.00427ce2
ret

Function at 0x40575f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x449
xor eax, eax
cmp word [ebp + 8], cx
jne 0x405786
push 1
push eax
push eax
push 0x442188
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
pop ebp
ret 8
Function at 0x40578a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437cc6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x44e278]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea esi, [edi + 0xc]
push 0xba
mov ecx, esi
mov dword [edi + 8], eax
call fcn.00415b3d
mov eax, dword [esi]
mov ecx, esi
push 0x43e
push dword [edi + 8]
call dword [eax + 8]
lea ecx, [edi + 0x88]
mov ebx, 0x717171
mov eax, dword [ecx]
push 0x43f
push dword [edi + 8]
mov dword [edi + 0x90], ebx
call dword [eax + 8]
lea ecx, [edi + 0x100]
mov dword [edi + 0x108], ebx
mov eax, dword [ecx]
push 0x440
push dword [edi + 8]
call dword [eax + 8]
lea ecx, [edi + 0x178]
mov dword [edi + 0x180], ebx
mov eax, dword [ecx]
push 0x441
push dword [edi + 8]
call dword [eax + 8]
lea ecx, [edi + 0x1f0]
mov dword [edi + 0x1f8], ebx
mov eax, dword [ecx]
push 0x442
push dword [edi + 8]
call dword [eax + 8]
lea ecx, [edi + 0x268]
mov dword [edi + 0x270], ebx
mov eax, dword [ecx]
push 0x443
push dword [edi + 8]
call dword [eax + 8]
lea ecx, [edi + 0x2e0]
mov dword [edi + 0x2e8], ebx
mov eax, dword [ecx]
push 0x444
push dword [edi + 8]
call dword [eax + 8]
lea esi, [edi + 0x358]
xor ebx, ebx
push 0x4421e0
lea ecx, [esp + 0x18]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], 0xfffffffd
call fcn.00401590
push 0xffffffffffffffff
lea eax, [esp + 0x18]
mov dword [esp + 0x54], ebx
push eax
mov ecx, esi
call fcn.004022fd
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x14]
push ebx
push 1
call fcn.004017dc
mov eax, 0x717171
mov ebx, 0xd77800
mov dword [edi + 0x360], eax
mov ecx, esi
mov dword [edi + 0x414], eax
mov eax, dword [esi]
push 0x446
push dword [edi + 8]
mov dword [edi + 0x418], ebx
call dword [eax + 8]
mov esi, 0x717171
lea ecx, [edi + 0x424]
mov eax, dword [ecx]
mov dword [edi + 0x42c], esi
push 0x447
push dword [edi + 8]
call dword [eax + 8]
push 0x442224
lea ecx, [esp + 0x30]
mov dword [edi + 0x4a4], esi
mov dword [edi + 0x530], ebx
mov dword [edi + 0x4b4], 0xc16200
mov dword [edi + 0x4b0], 0xed8e16
call fcn.00401590
xor ebx, ebx
lea eax, [esp + 0x2c]
push 0x40e
lea esi, [edi + 0x49c]
inc ebx
push eax
mov ecx, esi
mov dword [esp + 0x58], ebx
call fcn.004022fd
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x2c]
push 0
push ebx
call fcn.004017dc
mov eax, dword [esi]
mov ecx, esi
push 0x449
push dword [edi + 8]
call dword [eax + 8]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405cf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
movzx eax, ax
sub eax, 0x3fd
je 0x405d19
dec eax
dec eax
jne 0x405d48
push 1
push ecx
push ecx
push str.https:__yandex.ru_soft_distribution_
jmp 0x405d3a
mov eax, dword [ebp + 0xc]
sub eax, 0x40c
je 0x405d31
dec eax
jne 0x405d48
push 1
push ecx
push ecx
push str.https:__yandex.ru_legal_desktop_software_agreement_
jmp 0x405d3a
push 1
push ecx
push ecx
push str.https:__yandex.ru_legal_browser_agreement_
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov cl, 1
mov al, cl
pop ebp
ret 8
Function at 0x4088cf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x438272
call fcn.00427d33
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], eax
call fcn.00406947
lea eax, [ebp - 0x20]
xor ecx, ecx
push eax
push 0x20119
push ecx
mov dword [ebp - 4], ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebx], vtable.OfferOpera.0
mov byte [ebx + 0xd0], cl
mov dword [ebp - 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4089b5
push str.InstallDate
lea ecx, [ebp - 0x44]
call fcn.00401590
push 4
pop edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push ecx
lea ecx, [ebp - 0x1c]
xor esi, esi
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40896e
cmp dword [ebp - 0x14], edi
jne 0x40896e
cmp dword [ebp - 0x18], edi
cmove esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], esi
push 0
call fcn.00424dca
pop ecx
mov edi, eax
lea ecx, [ebp - 0x44]
sub edi, dword [ebp - 0x24]
mov esi, edx
push 0
push 1
sbb esi, 0
call fcn.004017dc
push 0
push 0x15180
push esi
push edi
call fcn.004374d0
test edx, edx
jg 0x4089ac
jl 0x4089a5
cmp eax, 0x1e
jae 0x4089ac
mov byte [ebx + 0xd0], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x28]
mov ecx, ebx
call fcn.00406bcc
cmp byte [ebx + 0xd0], 0
mov eax, 0x443ab4
mov esi, 0x443aac
cmove esi, eax
mov ecx, esi
call fcn.00402286
push eax
push esi
lea ecx, [ebx + 0x74]
call fcn.0040196f
mov eax, ebx
call fcn.00427ce2
ret 4
Function at 0x4089ee
Capabilities:
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x44e278]
xor eax, esp
mov dword [esp + 0x60], eax
and dword [esp], 0
lea eax, [esp]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
push eax
mov edi, 0x20119
push edi
push 0
push str.SoftwareOpera_Software
push 0x80000001
call esi
test eax, eax
setne bl
test bl, bl
je 0x408a6a
lea eax, [esp + 0xc]
push eax
push edi
push 0
push str.SoftwareOpera_Software
push 0x80000002
call esi
test eax, eax
setne bl
test bl, bl
je 0x408a6a
lea eax, [esp + 0xc]
push eax
push edi
push 0
push str.SoftwareWow6432NodeOpera_Software
push 0x80000002
call esi
test eax, eax
setne bl
test bl, bl
jne 0x408a7c
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x408b47
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x408aa0
cmp dword [esp + 0x34], 0
ja 0x408aa0
jb 0x408a9e
cmp dword [esp + 0x30], 0x60000000
jae 0x408aa0
xor bl, bl
test bl, bl
je 0x408b47
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4439ec
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x408adb
cmp dword [esp + 0x14], 0
ja 0x408adb
jb 0x408ad9
cmp dword [esp + 0x10], 0x20000000
jae 0x408adb
xor bl, bl
test bl, bl
je 0x408b47
and dword [esp + 0x3c], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x3c]
xor ecx, ecx
inc ecx
test eax, eax
cmove eax, ecx
imul edi, eax, 0x18
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x408b33
push edi
push esi
push 0
push 0
push 0xb
call dword [sym.imp.POWRPROF.dll_CallNtPowerInformation]
test eax, eax
jne 0x408b2c
cmp dword [esi + 4], 0x5dc
movzx ebx, bl
cmovb ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x408b47
push 0
xor edx, edx
push 6
inc edx
pop ecx
call fcn.0040880a
pop ecx
mov bl, al
mov ecx, dword [esp + 0x6c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00424209
mov esp, ebp
pop ebp
ret
Function at 0x4114d7
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x439743
call fcn.00427d33
mov edi, ecx
cmp dword [edi + 0x2c], 0xffffffff
jne 0x41160d
cmp byte [edi + 0x10], 0
je 0x41160d
lea esi, [edi + 0x14]
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x41150b
mov eax, dword [esi]
jmp 0x41150d
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.00413245
test al, al
jne 0x41156f
lea ecx, [ebp - 0x48]
call fcn.004127c1
push eax
lea ecx, [ebp - 0x30]
call fcn.004015c0
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004017dc
cmp dword [ebp - 0x20], 0
jbe 0x411602
mov ebx, 0x4446c4
mov ecx, ebx
call fcn.00402286
push eax
push ebx
lea ecx, [ebp - 0x30]
call fcn.00405183
xor ebx, ebx
cmp dword [ebp - 0x20], 0
jbe 0x411602
lea eax, [ebp - 0x30]
cmp esi, eax
je 0x41158b
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00401b92
mov ebx, str.multi_setup.log
mov ecx, ebx
call fcn.00402286
push eax
push ebx
mov ecx, esi
call fcn.00405183
cmp dword [esi + 0x14], 8
jb 0x4115a8
mov esi, dword [esi]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push 4
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x2c], eax
cmp eax, 0xffffffff
je 0x411602
push ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push 3
lea ecx, [ebp - 0x14]
mov word [ebp - 0x14], 0xbbef
push ecx
push eax
mov byte [ebp - 0x12], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4115ef
cmp dword [ebp - 0x18], 3
je 0x411602
cmp dword [edi + 0x2c], 0xffffffff
je 0x411602
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x2c], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004017dc
xor eax, eax
cmp dword [edi + 0x2c], 0xffffffff
setne al
call fcn.00427ce2
ret
Function at 0x41161c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0xc]
cmp dword [edi + 0x10], ebx
jbe 0x4116db
cmp byte [esi + 0x10], 1
jne 0x4116b9
mov ecx, esi
call fcn.004114d7
test al, al
je 0x4116b6
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
jb 0x411670
mov eax, dword [edi]
jmp 0x411672
mov eax, edi
push ebx
lea edx, [ebp - 0xc]
push edx
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4116b6
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jne 0x4116b6
push ebx
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0xa0d
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4116b6
cmp dword [ebp - 0xc], 2
jne 0x4116b6
mov bl, 1
jmp 0x4116b9
mov byte [esi + 0x10], bl
cmp byte [esi + 0x10], 0
jne 0x4116db
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x18
cdq
pop ecx
idiv ecx
cmp eax, 0x40000
jae 0x4116db
push edi
mov ecx, esi
call fcn.00411943
mov bl, 1
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret 4
Function at 0x4123f6
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x10
mov eax, 0x43994c
call fcn.00427d33
mov edi, edx
mov esi, ecx
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], edx
mov byte [esi], dl
xor ebx, ebx
mov dword [ebp - 4], edx
inc ebx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x18], ebx
jb 0x41242d
mov eax, dword [edi]
jmp 0x41242f
mov eax, edi
lea ecx, [ebp - 0x14]
push ecx
push edx
push ebx
push dword [edi + 0x10]
mov ebx, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push eax
call ebx
test eax, eax
je 0x412489
push 0
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00412491
cmp dword [esi + 0x14], 0x10
jb 0x41245b
mov eax, dword [esi]
jmp 0x41245d
mov eax, esi
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
jb 0x412468
mov edi, dword [edi]
lea edx, [ebp - 0x14]
push edx
push eax
push 1
push ecx
push edi
call ebx
test eax, eax
jne 0x412489
and dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x412484
mov eax, dword [esi]
jmp 0x412486
mov eax, esi
mov byte [eax], 0
mov eax, esi
call fcn.00427ce2
ret

Function at 0x412c0b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
lea ecx, [ebp - 0xc]
push edi
push ecx
xor edi, edi
mov dword [ebp - 0x10], eax
push eax
mov ebx, edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 8], eax
test eax, eax
je 0x412c8e
push eax
call fcn.00424c0b
mov esi, eax
pop ecx
test esi, esi
je 0x412c8e
push esi
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x412c87
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4446c4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x412c87
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xfeef04bd
jne 0x412c87
mov ebx, dword [eax + 8]
xor ecx, ecx
or ecx, dword [eax + 0xc]
or ebx, edi
mov edi, ecx
push esi
call fcn.00424a66
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
mov edx, ebx
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret

Function at 0x413023
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
pop ebx
xor esi, esi
mov dword [ebp - 8], ebx
mov edi, esi
cmp dword [edx + 0x14], ebx
jb 0x413047
mov edx, dword [edx]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413071
cmp dword [ebp - 8], ebx
jne 0x413071
cmp dword [ebp - 0xc], 0xb
jne 0x413071
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret
Function at 0x413245
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0x104
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x105
ja 0x41328c
test eax, eax
je 0x41328c
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.0040196f
inc bl
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret

Function at 0x41329e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4132fd
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push edi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4132f6
cmp dword [ebp - 8], edi
jne 0x4132f6
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret

Function at 0x413310
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, edx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x413366
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp - 0xc]
test eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 8]
setne bl
push esi
mov dword [edi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret

Function at 0x413379
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ecx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4133d8
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push edi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4133d1
cmp dword [ebp - 8], edi
jne 0x4133d1
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424209
mov esp, ebp
pop ebp
ret
Function at 0x413495
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x28
mov eax, 0x439c6f
call fcn.00427d33
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
xor eax, eax
mov dword [ebp - 4], ebx
push 0xf0000000
inc eax
mov dword [ebp - 0x28], ebx
push eax
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x413582
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x413578
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x413505
mov esi, dword [esi]
push ebx
push eax
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41356f
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41356f
mov esi, ebx
cmp dword [ebp - 0x2c], esi
jbe 0x41356f
movzx eax, byte [ebp + esi - 0x20]
mov ecx, edi
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef]
push eax
call fcn.004103f4
movzx eax, byte [ebp + esi - 0x20]
mov ecx, edi
and eax, 0xf
movzx eax, byte [eax + str.0123456789abcdef]
push eax
call fcn.004103f4
inc esi
cmp esi, dword [ebp - 0x2c]
jb 0x41353b
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
call fcn.00427ce2
ret

Function at 0x4142c9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x439d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x44e278]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
call fcn.004140bb
mov edx, dword [esi]
mov bl, al
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call dword [edx + 0x88]
and dword [esp + 0x30], 0
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.004022fd
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.004017dc
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4168cb
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x78], ebx
je 0x4168dd
xor eax, eax
jmp 0x4169d6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x80], eax
jne 0x4168d6
call fcn.00417278
test eax, eax
jne 0x4168d6
push edi
push dword [0x44f2fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4168d6
cmp dword [edi + 0x84], ebx
jne 0x416998
push esi
push 0x444e44
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [edi + 0x84], eax
call esi
push str.FDICopy
push dword [edi + 0x84]
mov dword [edi + 0x88], eax
call esi
push str.FDIIsCabinet
push dword [edi + 0x84]
mov dword [edi + 0x8c], eax
call esi
push str.FDIDestroy
push dword [edi + 0x84]
mov dword [edi + 0x90], eax
call esi
mov dword [edi + 0x94], eax
pop esi
cmp dword [edi + 0x88], ebx
je 0x41698d
cmp dword [edi + 0x8c], ebx
je 0x41698d
cmp dword [edi + 0x90], ebx
je 0x41698d
test eax, eax
jne 0x416998
mov dword [edi + 0x84], ebx
jmp 0x4168d6
lea eax, [edi + 0x54]
push eax
push 1
push 0x417112
push 0x4170f6
push 0x4170d4
push 0x4170b2
push 0x417092
push 0x41708d
push fcn.00417084
call dword [edi + 0x88]
xor ecx, ecx
mov dword [edi + 0x78], eax
add esp, 0x24
test eax, eax
setne cl
mov eax, ecx
pop edi
pop ebx
ret

Function at 0x416ffd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425ce2
add esp, 0xc
pop ebp
ret 0xc

Function at 0x417055
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
test dword [ebp + 0xc], 0x100
je 0x41706f
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004271e6
add esp, 0xc
pop ebp
ret 0xc

Function at 0x41802c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 7
mov esi, ecx
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
dec eax
neg eax
pop esi
sbb eax, eax
inc eax
pop ebp
ret 4