joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415578
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x415686
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x24]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.0040f084
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415668
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b0
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x415661
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x415698
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x415631
call fcn.0040316c
jmp 0x415668
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415668
mov eax, dword [ebp - 0x1c]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41568d
lea eax, [ebp - 0x24]
call fcn.004035b4
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x415ab8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x415d28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.00418748
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00406e44
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.00416658
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406e44
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x415d3c
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00415ff4
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040387c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404c2e
lea eax, [ebp - 0x1cc]
call fcn.00404eb6
call fcn.00402674
push ebp
mov eax, 0x415d4c
call fcn.00415a48
pop ecx
push ebp
push 0x415d5c
push dword [ebp - 0x1e0]
push 0x415d6c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415a48
pop ecx
push ebp
push 0x415d78
push dword [ebp - 0x1e0]
push 0x415d6c
push 0x415d8c
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415a48
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x415c27
push ebp
push 0x415da0
push dword [ebp - 0x1d8]
push 0x415d6c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415a48
pop ecx
push ebp
push 0x415d5c
push dword [ebp - 0x1d4]
push 0x415d6c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415a48
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404cd0
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004029a4
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004039f4
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x415d6c
push dword [ebp - 0x1d4]
push 0x415d6c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.004039f4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x415cff
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415d2f
lea eax, [ebp - 0x238]
call fcn.004035b4
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004035d8
ret

Function at 0x415e60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00415e3c
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
cmp ebx, eax
jge 0x415e89
mov byte [ebp - 5], 0
jmp 0x415e8d
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x416214
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x41626f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x416250
test byte [ebp - 0xc], 0x10
jne 0x416254
xor eax, eax
jmp 0x416256
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416276
lea eax, [ebp - 4]
call fcn.004035b4
ret

Function at 0x41680c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x416975
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00416280
test al, al
je 0x416952
mov eax, dword [0x43a9ec]
cmp dword [eax], 1
jne 0x416873
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00406e78
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.004164fc
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0040364c
mov eax, dword [0x43a998]
mov al, byte [eax]
sub al, 2
jae 0x4168cf
mov eax, dword [0x43a998]
cmp dword [eax + 0xd], 0x457
jge 0x4168cf
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x416952
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x2c]
imul dword [ebp - 0x34]
test eax, eax
jns 0x4168c4
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 8], eax
jmp 0x416952
push 0x416984
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x416952
xor eax, eax
push ebp
push 0x41694b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x416994
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x416934
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x416934
mov eax, dword [ebp - 0x14]
shl eax, 0x16
mov edx, dword [ebp - 0x18]
shr edx, 0xa
or eax, edx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416952
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41697c
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004035d8
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x4169a8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00406cf4
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x417324
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406a8c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4173ad
xor eax, eax
push ebp
push 0x4173a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x417390
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403b60
mov eax, dword [ebp - 8]
call fcn.00403a00
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4173ad
mov eax, dword [ebp - 0xc]
call fcn.00406b54
ret
mov esp, ebp
pop ebp
ret

Function at 0x417ba0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
cmp dword [ebp - 4], 0
je 0x417bfe
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x417bfe
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.00403b60
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret

Function at 0x41820c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4182bc
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040cc90
xor eax, eax
push ebp
push 0x41829f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x418278
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403768
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00403830
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x418256
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4182a6
mov eax, dword [ebp - 4]
call fcn.0040cd4c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
ret
Function at 0x41849c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41857b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403830
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403b60
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004164fc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0xc]
call fcn.004070c4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004164fc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00406790
test eax, eax
jne 0x418560
mov eax, dword [0x43a9ec]
cmp dword [eax], 1
jne 0x418553
lea eax, [ebp - 0xc]
call fcn.004185ac
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004164fc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, 0x418590
call fcn.0040387c
jmp 0x418560
mov eax, dword [ebp - 4]
mov edx, 0x4185a0
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418582
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004035d8
ret

Function at 0x424ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x424f15
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x424f05
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x429748
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov esi, eax
xor eax, eax
push ebp
push 0x429897
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ax, word [ebp - 2]
mov word [esi + 0x17], ax
test byte [esi + 0x17], 1
setne al
xor al, 1
mov byte [esi + 0x14], al
mov eax, dword [esi + 0x1c]
call fcn.00406bc4
test al, al
je 0x429881
mov byte [esi + 0x15], 1
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x43a9d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
xor ecx, ecx
xor edx, edx
call fcn.00415ff4
mov ecx, dword [ebp - 8]
mov eax, dword [0x43a9d8]
mov eax, dword [eax]
mov edx, dword [eax + 0x24]
lea eax, [esi + 0x20]
call fcn.0040387c
mov eax, dword [esi + 0x1c]
call fcn.004119f4
xor ecx, ecx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
call fcn.004172f8
mov ebx, eax
test byte [ebp - 3], bl
je 0x429881
test byte [esi + 0x17], 4
je 0x4297f2
mov eax, dword [esi + 0x1c]
call fcn.004154b4
test byte [esi + 0x17], 8
je 0x429816
mov eax, dword [esi + 0x1c]
call fcn.004039f4
push eax
call sub.gdi32.dll_RemoveFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [esi + 0x1c]
call fcn.004169a8
test al, al
jne 0x429881
mov byte [esi + 0x2c], 1
lea eax, [esi + 0x24]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [esi + 0x24]
call fcn.004039f4
push eax
push 0
push 0x4298a8
lea edx, [ebp - 8]
mov eax, dword [esi + 0x1c]
call fcn.00406e44
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [esi + 0x24]
call fcn.004039f4
mov edx, eax
lea eax, [esi + 0x24]
call fcn.00403768
mov eax, dword [0x43a9d8]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x4298b4
call fcn.0042351c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42989e
lea eax, [ebp - 8]
call fcn.004035b4
ret
Function at 0x42d91c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42da99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406bc4
test al, al
je 0x42da68
mov eax, ebx
call fcn.004165a8
mov edi, eax
mov eax, ebx
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x42d96d
and esi, 0xfffffffe
mov eax, ebx
call fcn.00406b5c
call fcn.00406fc8
fstp qword [ebp - 8]
wait
lea eax, [ebp - 0xc]
call fcn.004035b4
mov byte [0x43a5b8], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0042cd68
pop ecx
dec eax
jne 0x42da83
cmp dword [0x43b74c], 0
je 0x42d9cb
mov eax, dword [0x43b74c]
test byte [eax + 0x25], 4
je 0x42d9cb
mov byte [0x43a5b8], 1
cmp byte [0x43a5b8], 0
je 0x42d9eb
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, 0x43b75c
mov ecx, pe_nt_image_headers32
call fcn.00425850
mov eax, 0x42d8ac
push eax
push 0
mov ecx, 0x42d878
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00417084
mov byte [ebp - 0xd], al
cmp byte [0x43a5b8], 0
je 0x42da18
mov eax, 0x43b75c
call fcn.00425950
cmp byte [ebp - 0xd], 0
je 0x42da4d
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x42da36
push esi
mov eax, dword [ebp - 0xc]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0042d4c4
jmp 0x42da83
mov eax, dword [0x43a8e8]
cmp byte [eax], 0
jne 0x42da83
mov byte [0x43b756], 1
mov eax, dword [0x43a8e8]
mov byte [eax], 1
jmp 0x42da83
mov eax, 0x43b744
mov edx, ebx
call fcn.00403608
mov byte [0x43b756], 1
mov eax, dword [0x43a8e8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42daa0
lea eax, [ebp - 0xc]
call fcn.004035b4
ret
Function at 0x436648
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x436974
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.00406f0c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.00406e44
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0042a838
test al, al
jne 0x4366ed
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x48]
mov eax, 0x16
call fcn.00429f58
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x54]
xor ecx, ecx
pop eax
call fcn.00407750
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
mov eax, dword [0x43a9d8]
mov eax, dword [eax]
call fcn.00422da0
mov edx, dword [ebp - 0x48]
mov eax, 0x436990
call fcn.0042ab48
jmp 0x43694c
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x14]
call fcn.004164fc
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, dword [ebp - 0x10]
call fcn.0040387c
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00406db0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
add eax, 0x1c
call fcn.00403608
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, 0x20
call fcn.00406a8c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43688a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
mov edi, eax
cmp edi, 0x10000
jle 0x43675f
mov edi, 0x10000
mov eax, edi
call fcn.004025b0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x436815
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, edi
neg edx
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.00406b48
mov edx, dword [ebp - 0x18]
mov ecx, edi
mov eax, dword [ebp - 0xc]
call fcn.00406af0
mov esi, edi
sub esi, 6
cmp esi, 0
jl 0x4367ff
mov eax, 0x4369a8
mov al, byte [eax]
call fcn.00402884
mov edx, dword [ebp - 0x18]
cmp al, byte [edx + esi]
jne 0x4367f9
mov byte [ebp - 0x19], 1
mov ebx, 1
mov eax, 0x4369a8
mov al, byte [eax + ebx]
call fcn.00402884
lea edx, [ebx + esi]
mov ecx, dword [ebp - 0x18]
cmp al, byte [ecx + edx]
je 0x4367e3
mov byte [ebp - 0x19], 0
jmp 0x4367e9
inc ebx
cmp ebx, 6
jne 0x4367c5
cmp byte [ebp - 0x19], 0
je 0x4367f9
sub edi, esi
sub edi, 6
mov dword [ebp - 0x20], edi
jmp 0x4367ff
dec esi
cmp esi, 0xffffffff
jne 0x4367a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43681c
mov eax, dword [ebp - 0x18]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43697b
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004035d8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004035d8
ret
Function at 0x40772f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x462154], 0
jne 0x40776d
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407743
mov dword [ecx*4 + 0x462150], eax
inc ecx
cmp ecx, 0x100
jl 0x40773e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40779a
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x462150]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40777b
not eax
pop ebp
ret 0xc

Function at 0x81a000
Capabilities:
Encode data using xor

Disassembly:
push 0x455f6c5
pop ecx
nop
nop
push 0x81a024
pop edi
nop
mov edx, 0x598
nop
nop
push dword [edx + edi]
xor dword [esp], ecx
pop dword [edx + edi]
nop
nop
sub edx, 4
jne 0x81a016
nop
nop
sub eax, 0xc504548b
not byte [ebp + 4]
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4085a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4085b7
pop dword [ebp - 0x34]
mov eax, 0x4085b7
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x39628
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x3cc9f467
sub ecx, 0x3cc9ac34
mov edi, eax
mov ebx, 0x1eac8eba
sub ebx, 0x1e6b52f6
add ebx, dword [ebp - 0x34]
mov esi, 0x64ce5fc7
sub esi, 0xd477a3c6
xor dword [ebp - 0x10], 0xd6d62e93
mov edx, dword [ebx]
xor dword [ebp - 0x30], 0xea7357bc
xor edx, esi
sub dword [ebp - 0x28], 0xea0ab5ec
mov dword [edi], edx
mov dword [ebp - 0x28], 0xb4755db4
add edi, 0xc335ec11
sub edi, 0xc335ec0d
add ebx, 0x35123af2
add ebx, 0xcaedc512
loop 0x40860c
add eax, 0x1139f
xor ebx, ebx
add ebx, eax
add eax, 0xaf8ea87b
sub eax, 0xaf8ea876
mov ecx, 0x602a4335
add ecx, 0xa015bccb
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1001ec5b
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x2b4
mov eax, 0x1009a716
call fcn.1005f529
mov esi, 0x114
lea eax, [ebp - 0x128]
push esi
xor edi, edi
push edi
push eax
call fcn.10077e00
add esp, 0xc
mov dword [ebp - 0x128], esi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1001ecd7
push ecx
push dword [0x100cd440]
lea ecx, [ebp - 0x208]
push edi
call fcn.100184c5
lea esi, [eax + 0x10]
mov dword [ebp - 4], edi
mov edx, str.GetVersionEx_failed__err_
mov ecx, esi
call fcn.10018d60
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.1000f350
lea ecx, [ebp - 0x208]
jmp 0x1001ee72
push 0x24
lea eax, [ebp - 0x14c]
push edi
push eax
call fcn.10077e00
add esp, 0xc
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x124]
xor esi, esi
inc esi
cmp eax, 4
jne 0x1001ed17
cmp dword [ebp - 0x118], esi
jne 0x1001ee21
xor eax, eax
jmp 0x1001ee7a
cmp eax, 5
jne 0x1001ed59
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x1001ed2c
inc eax
jmp 0x1001ee7a
cmp eax, esi
je 0x1001ed55
cmp eax, 2
jne 0x1001ee21
cmp word [ebp - 0x14c], 9
je 0x1001ed4d
cmp word [ebp - 0x14c], 6
jne 0x1001ed55
push 3
pop eax
jmp 0x1001ee7a
push 2
jmp 0x1001ed4f
push 6
pop edx
cmp eax, edx
jne 0x1001edf3
mov ecx, dword [ebp - 0x120]
test ecx, ecx
jne 0x1001ed8c
cmp word [ebp - 0x14c], 9
je 0x1001ed85
cmp word [ebp - 0x14c], dx
je 0x1001ed85
push 5
jmp 0x1001ed4f
mov eax, edx
jmp 0x1001ee7a
cmp ecx, esi
jne 0x1001edab
cmp word [ebp - 0x14c], 9
je 0x1001eda7
cmp word [ebp - 0x14c], dx
je 0x1001eda7
push 7
jmp 0x1001ed4f
push 8
jmp 0x1001ed4f
cmp ecx, 2
jne 0x1001edcd
push 9
pop eax
cmp word [ebp - 0x14c], ax
je 0x1001edc9
cmp word [ebp - 0x14c], dx
jne 0x1001ee7a
push 0xa
jmp 0x1001ed4f
cmp ecx, 3
jne 0x1001ee21
cmp word [ebp - 0x14c], 9
je 0x1001edec
cmp word [ebp - 0x14c], dx
je 0x1001edec
push 0xb
jmp 0x1001ed4f
push 0xc
jmp 0x1001ed4f
cmp eax, 0xa
jne 0x1001ee21
cmp dword [ebp - 0x120], edi
jne 0x1001ee21
cmp word [ebp - 0x14c], 9
je 0x1001ee1a
cmp word [ebp - 0x14c], dx
je 0x1001ee1a
push 0xd
jmp 0x1001ed4f
push 0xe
jmp 0x1001ed4f
push ecx
push dword [0x100cd440]
lea ecx, [ebp - 0x2c0]
push edi
call fcn.100184c5
mov dword [ebp - 4], esi
mov edx, str.Unknown_version:_major
lea esi, [eax + 0x10]
mov ecx, esi
call fcn.10018d60
push dword [ebp - 0x124]
mov ecx, esi
call fcn.1000f350
mov edx, str.__minor
mov ecx, esi
call fcn.10018d60
push dword [ebp - 0x120]
mov ecx, esi
call fcn.1000f350
lea ecx, [ebp - 0x2c0]
call fcn.10018441
or eax, 0xffffffff
call fcn.1005f4d3
ret