joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e7dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41e835
test eax, edx
je 0x41e838
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41e7f3
movzx eax, word [eax]
sub eax, ecx
jmp 0x41e81a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41e81b
add ecx, 4
js 0x41e80b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41e818
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41e81a
xor eax, eax
ret
test eax, eax
je 0x41e844
test edx, edx
jne 0x41e7e4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41fbcc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x41fbf9
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x41fccc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040a73c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41fd36
test ah, 4
je 0x41fd2f
test bl, bl
jne 0x41fcf4
mov al, 1
jmp 0x41fd5d
test al, 0x10
je 0x41fcfc
xor eax, eax
jmp 0x41fd5d
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41fd20
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x41fd5d
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x41fd5d
test al, 0x10
sete al
jmp 0x41fd5d
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x41fd57
cmp ebx, 3
je 0x41fd57
cmp ebx, 0x7b
je 0x41fd57
mov eax, esi
call fcn.0041fc8c
test al, al
jne 0x41fd5b
xor eax, eax
jmp 0x41fd5d
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x41fd64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040a73c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41fe0b
test esi, 0x400
jne 0x41fda0
test esi, 0x10
setne bl
jmp 0x41fe3b
cmp byte [esp], 0
je 0x41fdd4
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41fe3b
push eax
call sub.kernel32.dll_CloseHandle
test esi, 0x10
setne bl
jmp 0x41fe3b
test esi, 0x10
je 0x41fde0
mov bl, 1
jmp 0x41fe3b
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41fe07
push eax
call sub.kernel32.dll_CloseHandle
xor ebx, ebx
jmp 0x41fe3b
mov bl, 1
jmp 0x41fe3b
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x41fe35
cmp eax, 3
je 0x41fe35
cmp eax, 0xa1
je 0x41fe35
cmp eax, 0x7b
je 0x41fe35
cmp eax, 0x35
je 0x41fe35
cmp eax, 0x15
je 0x41fe35
cmp eax, 0x43
jne 0x41fe39
xor ebx, ebx
jmp 0x41fe3b
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41ff48
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040a73c
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x41ff9d
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41ff97
test ah, 4
je 0x41ff97
test al, 0x10
je 0x41ff97
mov eax, esi
call fcn.0040a73c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x41ff9d
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x423d98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x423dd1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409e3c
jmp 0x423dda
mov eax, ebx
mov edx, esi
call fcn.0040a094
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x423de4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x423e06
movzx eax, word [esp]
jmp 0x423e08
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x425104
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x425229
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00424f0c
mov esi, eax
mov eax, dword [0x4ffb40]
cmp byte [eax], 0
je 0x4251d1
mov eax, dword [0x4ff954]
call fcn.004077d4
call fcn.00406fbc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4250d4]
call fcn.0040be88
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x425244
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x42520d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4ff90c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x503628]
call fcn.0040c278
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425230
lea eax, [ebp - 4]
mov edx, dword [0x4250d4]
call fcn.0040bfac
ret
Function at 0x4262c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4263c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a0dc
lea eax, [ebp - 4]
call fcn.0040a1f8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a73c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4263b2
mov eax, ebx
call fcn.00406e68
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4263ab
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a73c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x426395
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4263dc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x426395
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4263b2
mov eax, dword [ebp - 0x10]
call fcn.00406e84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4263cf
lea eax, [ebp - 4]
call fcn.00409cb4
ret

Function at 0x42740c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a184
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040eea4
mov edi, eax
cmp edi, 0x104
jbe 0x4273b7
mov eax, edi
add eax, eax
call fcn.00406e68
mov esi, eax
jmp 0x4273b9
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040eea4
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4273f2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4273dc
mov eax, esp
cmp esi, eax
je 0x4273ff
mov eax, esi
call fcn.00406e84
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x427438
cmp bl, 0
je 0x427434
cmp bl, 0x41
jl 0x42742f
cmp bl, 0x5a
jg 0x42742f
or bl, 0x20
xor al, bl
inc esi
jmp 0x427413
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x427378

Function at 0x427c9c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a7e0
add esp, 0x800
pop ebx
ret
Function at 0x47fba4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47fbac
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b6eb8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6f56
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b6f1a
cmp byte [ebx + 0x11], 0
jne 0x4b6f1a
cmp byte [ebx + 0x24], 0
jne 0x4b6f1a
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b6f3b
lea edx, [ebp - 4]
mov eax, dword [0x4ffaec]
call fcn.0040ee10
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48f080]
call fcn.00425254
call fcn.004093b0
jmp 0x4b6f3b
lea edx, [ebp - 8]
mov eax, dword [0x4ffaec]
call fcn.0040ee10
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48f080]
call fcn.00425254
call fcn.004093b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6f5d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409d14
ret

Function at 0x4b7770
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b77be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b6d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b77d7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4dbb8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, edx
lea eax, [ebp - 0x208]
xor ecx, ecx
mov edx, 0x208
call fcn.00407838
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040a7e0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e2b7c
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004e2a90
mov esi, dword [ebx + 0x38]
test esi, esi
je 0x4e2c4a
cmp esi, 0xffffffff
je 0x4e2c4a
push 0
push esi
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebx + 0x2c], 0
jne 0x4e2bbb
cmp dword [ebx + 0x28], 0
je 0x4e2bfe
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax]
call dword [edx]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
cmp edx, dword [ebx + 0x2c]
jne 0x4e2bd6
cmp eax, dword [ebx + 0x28]
jbe 0x4e2bfe
jmp 0x4e2bd8
jle 0x4e2bfe
push 0
push 0
push 0
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_SetFilePointer
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_SetEndOfFile
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x4e2c0c
cmp dword [ebp - 0x10], 0
ja 0x4e2c25
jmp 0x4e2c0e
jg 0x4e2c25
push 0
lea eax, [ebp - 4]
push eax
push 2
mov eax, dword [0x4ffbf0]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
mov esi, dword [ebx + 0x3c]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WriteFile
mov eax, dword [ebx + 0x3c]
call fcn.004a9e3c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e2f38
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4e301f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4e2f6e
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00407c08
jmp 0x4e2f7e
lea eax, [ebp - 8]
mov edx, dword [0x4ffa60]
mov edx, dword [edx]
call fcn.0040a0dc
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4e2f8a
sub ebx, 4
mov ebx, dword [ebx]
push edi
push dword [ebp - 8]
lea ecx, [ebp - 0x10]
mov edx, 0x19
sub edx, ebx
inc edx
mov eax, dword [0x4ff928]
movzx eax, word [eax]
call fcn.0040ad28
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040aa18
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4e2fc2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4e2fd1
lea eax, [ebp - 4]
mov edx, dword [esi + 0x50]
call fcn.0040a938
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x4e303c
push 0x4e303c
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040aa18
mov eax, dword [ebp - 4]
call fcn.0040a73c
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3026
lea eax, [ebp - 0x10]
call fcn.00409cb4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409d14
ret
Function at 0x4f3dcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x210], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f3e6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x20a
call fcn.00407838
cmp bl, 1
cmc
sbb eax, eax
push eax
push esi
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4f3e45
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a7e0
mov eax, dword [ebp - 0x210]
mov edx, edi
call fcn.00426830
jmp 0x4f3e54
mov eax, edi
mov edx, dword [0x4ffb64]
mov edx, dword [edx]
call fcn.0040a094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3e74
lea eax, [ebp - 0x210]
call fcn.00409cb4
ret

Function at 0x4fbd84
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x4f6188
call fcn.004104f8
mov ax, 0x133f
call fcn.0040732c
mov eax, 0x4f5f54
call fcn.0041e6f4
mov eax, dword [0x4ffb74]
mov dword [eax], 0x4f5f58
mov eax, 0x4fbdd8
call fcn.004f5eb0
mov eax, dword [0x4f59a8]
call fcn.004f5aa4
call fcn.004099e4
add byte [eax - 0xfffdfc], dh
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4046a6
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
mov eax, dword [0x42600c]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x104
cmp word [esi + eax*2 - 2], 0x5c
je 0x4046ef
push 0x421014
mov edx, ebx
mov ecx, esi
call fcn.00403aa0
test eax, eax
js 0x40480e
push 0x208
lea eax, [esp + 0x46c]
push 0
push eax
call fcn.004095e0
pop ecx
pop ecx
push esi
push ecx
mov edx, 0x82
lea ecx, [esp + 0x474]
call fcn.00403b0e
test eax, eax
js 0x40480e
push 0x421668
mov edx, ebx
lea ecx, [esp + 0x46c]
call fcn.00403aa0
test eax, eax
js 0x40480e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x404800
push 0x208
lea eax, [esp + 0x264]
push 0
push eax
call fcn.004095e0
pop ecx
pop ecx
push esi
push ecx
mov edx, 0x82
lea ecx, [esp + 0x26c]
call fcn.00403b0e
test eax, eax
js 0x40480e
lea eax, [esp + 0x3c]
mov edx, ebx
push eax
lea ecx, [esp + 0x264]
call fcn.00403aa0
test eax, eax
js 0x40480e
test byte [esp + 0x10], 0x10
je 0x4047de
push 0x42166c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4047ec
push 0x421670
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4047ec
lea ecx, [esp + 0x260]
call fcn.004046a6
jmp 0x4047ec
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404750
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040797f
invalid
mov esp, ebp
pop ebp
ret

Function at 0x404823
Capabilities:
Get common file path

Disassembly:
push 0x41c
mov eax, 0x41a46b
call fcn.004198de
mov esi, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.00404298
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
call fcn.00406594
lea eax, [ebp - 0x425]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x424]
push esi
mov byte [ebp - 0x425], bl
call fcn.0040692b
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4048bc
push str.AdobeARM1.0Temp
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.00403aa0
test eax, eax
js 0x4048bc
lea ecx, [ebp - 0x218]
call fcn.004046a6
call fcn.00419888
ret
Function at 0x40757d
Capabilities:
Enumerate pe sections

Disassembly:
cmp eax, ebx
je 0x407b82
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.00407389
dec ebp
vmwrite esi, dword [esi]
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
invalid
test dword [edi + edi*8 - 1], ecx

Function at 0x407c05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
jmp dword [0xfcac858d]
invalid
call dword [eax - 0x18]
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
adc al, 0xf7
invalid
Function at 0x408267
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00407367
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00407399
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040734e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00407389
xchg ecx, eax
mov byte ss:[edx + 0x68], ch
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00407389
mov dl, 0xe2
add al, 0xe5
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00407399
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040734e
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x408435
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x408455
mov eax, dword [ebp - 0x550]
dec eax

Function at 0x40881f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00407389
or eax, edi
adc byte [esi - 0x73], dh
test esp, edx
clc
invalid