joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa7c42b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a7c3a7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0xa7c5a3
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0xa7c5a3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0xa7c552
jg 0xa7c484
test eax, eax
je 0xa7c548
push 1
push 0x1000
call fcn.00a66151
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0xa7c4aa
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0xa7c53f
push 0x8000
push ebx
call fcn.00a6480e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0xa7c4d6
jg 0xa7c4d1
cmp ecx, 0x1000
jb 0xa7c4d6
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00a7bca7
add esp, 0x10
cmp eax, 0xffffffff
je 0xa7c51b
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0xa7c4d1
jl 0xa7c502
test ecx, ecx
jne 0xa7c4c3
push dword [ebp - 0xc]
push ebx
call fcn.00a6480e
push esi
call fcn.00a66e78
add esp, 0xc
xor edi, edi
jmp 0xa7c5b4
cmp byte [edi + 0x24], 0
je 0xa7c532
cmp dword [edi + 0x20], 5
jne 0xa7c532
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0xa7c53d
mov edi, dword [edi + 0x18]
jmp 0xa7c53f
xor edi, edi
push esi
call fcn.00a66e78
pop ecx
jmp 0xa7c5b4
test ecx, ecx
jg 0xa7c514
jl 0xa7c552
test eax, eax
jae 0xa7c514
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a70e77
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0xa7c575
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa7c514
jmp 0xa7c5ac
push ebx
call fcn.00a75753
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xa7c514
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0xa7c5b4
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa7c5b1
mov edi, dword [edi + 0x18]
jmp 0xa7c5b4
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00a70e77
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0xa8238d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data_1]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404990
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d60
call fcn.00410510
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x494138]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x49413c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x1c], edx
call fcn.00404980
mov ecx, dword [0x494140]
mov edx, dword [0x494144]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x20
jmp 0x404a00
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov esi, dword [ebp - 0xc]
mov eax, dword [0x4ac254]
shl esi, 4
add esi, dword [ebp - 0x24]
cmp eax, 0xfa9
jne 0x404a2c
mov dword [0x4ac250], 0xedeb2e40
jmp 0x404a47
cmp eax, 0x3eb
jne 0x404a47
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x4abce0], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x4ac254], 0x9e6
mov dword [0x4ac24c], 0xf4ea3dee
jne 0x404a82
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x4ac254], 0x213
jne 0x404b20
push 0
lea eax, [ebp - 0x960]
push eax
push 0
push 0
push 0
push 0
call ebx
lea ecx, [ebp - 0x1560]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
lea ecx, [ebp - 0x1d60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub edi, dword [ebp - 4]
cmp dword [0x4ac254], 0xc
jne 0x404b3e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, dword [ebp - 8]
mov edx, edi
shr edx, 5
lea ecx, [eax + edi]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
xor eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
sub dword [ebp - 8], eax
sub dword [ebp - 0x14], 1
jne 0x404a00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404b90
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1808
call fcn.00410510
mov eax, dword [0x4ac254]
mov ecx, dword [0x4abce4]
shr eax, 3
test eax, eax
jbe 0x404ca8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x4ac254], 0x959
jne 0x404c8e
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x1008]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1808]
push eax
push 0
call edi
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404990
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404bd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x493540]
jne 0x408b96
repz ret
jmp fcn.0040c8db

Function at 0x40b883
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409ac6
and dword [ebp - 4], 0
cmp dword [0x4992f4], 0
mov ebx, eax
jne 0x40b934
push 0x4024bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b9e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024b0
push edi
call esi
test eax, eax
je 0x40b9e5
push eax
call fcn.00409a54
mov dword [esp], 0x4024a0
push edi
mov dword [0x4992f4], eax
call esi
push eax
call fcn.00409a54
mov dword [esp], 0x40248c
push edi
mov dword [0x4992f8], eax
call esi
push eax
call fcn.00409a54
mov dword [esp], 0x402470
push edi
mov dword [0x4992fc], eax
call esi
push eax
call fcn.00409a54
pop ecx
mov dword [0x499304], eax
test eax, eax
je 0x40b934
push 0x402458
push edi
call esi
push eax
call fcn.00409a54
pop ecx
mov dword [0x499300], eax
mov eax, dword [0x499300]
cmp eax, ebx
je 0x40b98c
cmp dword [0x499304], ebx
je 0x40b98c
push eax
call fcn.00409acf
push dword [0x499304]
mov esi, eax
call fcn.00409acf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b98c
test edi, edi
je 0x40b98c
call esi
test eax, eax
je 0x40b983
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b983
test byte [ebp - 0xc], 1
jne 0x40b98c
or dword [ebp + 0x10], 0x200000
jmp 0x40b9c5
mov eax, dword [0x4992f8]
cmp eax, ebx
je 0x40b9c5
push eax
call fcn.00409acf
pop ecx
test eax, eax
je 0x40b9c5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b9c5
mov eax, dword [0x4992fc]
cmp eax, ebx
je 0x40b9c5
push eax
call fcn.00409acf
pop ecx
test eax, eax
je 0x40b9c5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4992f4]
call fcn.00409acf
pop ecx
test eax, eax
je 0x40b9e5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b9e7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401508
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x401577
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x4015a5
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403064
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015bf
pop esi
ret
push edi
push 0
push 0x349ac5
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015f4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401601
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401652
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40165e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401660
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10d91058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10d911a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10d9107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d9106a
add dl, dl
jne 0x10d91089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d910dc
xor eax, eax
add dl, dl
jne 0x10d91096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d9117d
add dl, dl
jne 0x10d910a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d910b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d910bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d910c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10d910d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10d91075
mov eax, 1
add dl, dl
jne 0x10d910ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d910f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d910e1
sub eax, ebx
mov ebx, 1
jne 0x10d91128
mov ecx, 1
add dl, dl
jne 0x10d9110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d91119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d91105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d91075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10d9113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d9114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d91136
cmp eax, 0x7d00
jae 0x10d9116d
cmp eax, 0x500
jb 0x10d91168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d91075
cmp eax, 0x7f
ja 0x10d91170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d91075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10d9119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10d91075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6cfd4ddb
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d888018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d888018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6cfd4e56
jmp 0x6cfd4eb1
jmp 0x6cfd4f0c
jmp 0x6cfd4f67
jmp 0x6cfd4fc2
jmp 0x6cfd501d
jmp 0x6cfd5078
jmp 0x6cfd50d3
jmp 0x6cfd512e
jmp 0x6cfd5189
jmp 0x6cfd51e4
jmp 0x6cfd523f
jmp 0x6cfd529a
mov dword [ebp - 0x14], 0
jmp 0x6cfd52fc
jmp 0x6cfd5357
jmp 0x6cfd53b2
jmp 0x6cfd540d
jmp 0x6cfd5468
jmp 0x6cfd54c3
jmp 0x6cfd551e
jmp 0x6cfd5579
jmp 0x6cfd55d4
jmp 0x6cfd562f
jmp 0x6cfd568a
jmp 0x6cfd56e5
jmp 0x6cfd5740
mov dword [ebp - 0x18], 0
jmp 0x6cfd57a2
jmp 0x6cfd57fd
jmp 0x6cfd5858
jmp 0x6cfd58b3
jmp 0x6cfd590e
jmp 0x6cfd5969
jmp 0x6cfd59c4
jmp 0x6cfd5a1f
jmp 0x6cfd5a7a
jmp 0x6cfd5ad5
jmp 0x6cfd5b30
jmp 0x6cfd5b8b
jmp 0x6cfd5be6
mov dword [ebp - 0x10], 0
jmp 0x6cfd5c48
jmp 0x6cfd5ca3
jmp 0x6cfd5cfe
jmp 0x6cfd5d59
jmp 0x6cfd5db4
jmp 0x6cfd5e0f
jmp 0x6cfd5e6a
jmp 0x6cfd5ec5
jmp 0x6cfd5f20
jmp 0x6cfd5f7b
jmp 0x6cfd5fd6
jmp 0x6cfd6031
jmp 0x6cfd608c
mov dword [ebp - 0x10], 0
jmp 0x6cfd77fb
jmp 0x6cfd60f3
jmp 0x6cfd614e
jmp 0x6cfd61a9
jmp 0x6cfd6204
jmp 0x6cfd625f
jmp 0x6cfd62ba
jmp 0x6cfd6315
jmp 0x6cfd6370
jmp 0x6cfd63cb
jmp 0x6cfd6426
jmp 0x6cfd6481
jmp 0x6cfd64dc
jmp 0x6cfd6537
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6d888014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6cfd65a3
jmp 0x6cfd65fe
jmp 0x6cfd6659
jmp 0x6cfd66b4
jmp 0x6cfd670f
jmp 0x6cfd676a
jmp 0x6cfd67c5
jmp 0x6cfd6820
jmp 0x6cfd687b
jmp 0x6cfd68d6
jmp 0x6cfd6931
jmp 0x6cfd698c
jmp 0x6cfd69e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6d88801c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6cfd6a53
jmp 0x6cfd6aae
jmp 0x6cfd6b09
jmp 0x6cfd6b64
jmp 0x6cfd6bbf
jmp 0x6cfd6c1a
jmp 0x6cfd6c75
jmp 0x6cfd6cd0
jmp 0x6cfd6d2b
jmp 0x6cfd6d86
jmp 0x6cfd6de1
jmp 0x6cfd6e3c
jmp 0x6cfd6e97
mov eax, dword [0x6d888008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x6cfd6f10
jmp 0x6cfd6f6b
jmp 0x6cfd6fc6
jmp 0x6cfd7021
jmp 0x6cfd707c
jmp 0x6cfd70d7
jmp 0x6cfd7132
jmp 0x6cfd718d
jmp 0x6cfd71e8
jmp 0x6cfd7243
jmp 0x6cfd729e
jmp 0x6cfd72f9
jmp 0x6cfd7354
add dword [ebp - 0xc], 0x28
jmp 0x6cfd73b3
jmp 0x6cfd740e
jmp 0x6cfd7469
jmp 0x6cfd74c4
jmp 0x6cfd751f
jmp 0x6cfd757a
jmp 0x6cfd75d5
jmp 0x6cfd7630
jmp 0x6cfd768b
jmp 0x6cfd76e6
jmp 0x6cfd7741
jmp 0x6cfd779c
jmp 0x6cfd77f7
add dword [ebp - 0x10], 1
mov eax, dword [0x6d888018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6cfd6098
nop
leave
ret
Function at 0x405c49
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405f14
test bl, 8
mov dword [ebp - 8], eax
je 0x405c88
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434f88], eax
jmp 0x405e05
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405ca2
test eax, eax
je 0x405db3
test bl, 2
je 0x405db3
mov esi, 0x42f270
push edi
push esi
call fcn.0040653d
cmp dword [ebp + 8], 0
je 0x405cc1
push 0x40a56c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405cc7
push edi
call fcn.00405e58
cmp word [edi], 0
jne 0x405cd7
cmp word [0x42f270], 0x5c
jne 0x405ce2
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405da8
cmp word [ebp - 0x22c], 0x2e
jne 0x405d2c
cmp word [ebp - 0x22a], 0
je 0x405d8b
cmp word [ebp - 0x22a], 0x2e
jne 0x405d2c
cmp word [ebp - 0x228], 0
je 0x405d8b
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040653d
test byte [ebp - 0x258], 0x10
je 0x405d57
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405d8b
push dword [ebp + 0xc]
push edi
call fcn.00405c49
jmp 0x405d8b
push dword [ebp - 4]
push edi
call fcn.00405c01
test eax, eax
jne 0x405d83
cmp dword [ebp - 4], eax
je 0x405d7b
push edi
push 0xfffffffffffffff1
call fcn.0040559f
push 0
push edi
call fcn.004062fd
jmp 0x405d8b
inc dword [0x434f88]
jmp 0x405d8b
push edi
push 0xfffffffffffffff2
call fcn.0040559f
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405d04
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405db3
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405e05
cmp dword [ebp - 8], esi
jne 0x405dc7
inc dword [0x434f88]
jmp 0x405e05
push edi
call fcn.00406873
test eax, eax
je 0x405e05
push edi
call fcn.00405e0c
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405c01
test eax, eax
jne 0x405dfd
cmp dword [ebp - 4], esi
je 0x405dbf
push edi
push 0xfffffffffffffff1
call fcn.0040559f
push esi
push edi
call fcn.004062fd
jmp 0x405e05
push edi
push 0xffffffffffffffe5
call fcn.0040559f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40b801
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a00
cmp edx, dword [eax]
je 0x40b823
add eax, 8
inc ecx
cmp eax, 0x411a90
jl 0x40b814
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a00]
jne 0x40b951
mov eax, dword [0x41911c]
cmp eax, 1
je 0x40b92b
test eax, eax
jne 0x40b854
cmp dword [0x411488], 1
je 0x40b92b
cmp edx, 0xfc
je 0x40b951
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408910
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b8ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408910
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41050c
push edi
call fcn.00408fa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408750
lea eax, [ebp - 0xa0]
push 0x4104ec
push eax
call fcn.00408750
push dword [esi + 0x411a04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e2c6
add esp, 0x2c
pop edi
jmp 0x40b951
lea eax, [ebp + 8]
lea esi, [esi + 0x411a04]
push 0
push eax
push dword [esi]
call fcn.00408910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x319f079c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x314e7dc0
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219