joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1155138
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf90]
mov eax, 0x1010
call fcn.01163380
mov eax, dword [0x117104c]
xor eax, ebp
mov dword [ebp + 0xf8c], eax
mov eax, dword [ebp + 0xf98]
push ebx
push esi
mov esi, dword [0x116b1fc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x7c], eax
push 4
lea eax, [ebp - 0x78]
push eax
push dword [edi]
call esi
cmp eax, 4
je 0x115517e
xor eax, eax
jmp 0x11551c6
cmp dword [ebp - 0x78], ebx
jbe 0x11551b5
push 0
push 0x1000
lea eax, [ebp - 0x74]
push eax
push dword [edi]
call esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x11551b5
mov ecx, dword [ebp - 0x7c]
push dword [ecx]
push eax
lea eax, [ebp - 0x74]
push 1
push eax
call fcn.01158fa9
add ebx, dword [ebp - 0x80]
add esp, 0x10
cmp ebx, dword [ebp - 0x78]
jb 0x1155183
mov eax, dword [ebp - 0x7c]
push dword [eax]
call fcn.01158dcb
cmp ebx, dword [ebp - 0x78]
pop ecx
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0xf8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.011588f2
add ebp, 0xf90
leave
ret

Function at 0x1156c3f
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x1156c4a
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x1156cfc
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x116e608]
inc ecx
sub edi, 8
dec esi
jne 0x1156c61
pop ebx
test edi, edi
je 0x1156d15
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x116e608]
inc ecx
dec edi
jne 0x1156d00
pop esi
not eax
pop edi
ret

Function at 0x1156d1a
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x116e608]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x116e608]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x1158b14
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], edi
je 0x1158ad6
cmp dword [ebp + 0x14], edi
je 0x1158ad6
cmp ecx, edi
jne 0x1158add
call fcn.0115a8c2
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0115a85a
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x1158af1
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x1158b12
cmp ebx, 0xffffffff
je 0x1158b01
push ebx
push edi
push ecx
call fcn.0115ba10
add esp, 0xc
cmp esi, edi
je 0x1158abe
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x1158abe
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test dword [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x1158b2f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x1158b36
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x1158c28
test dword [esi + 0xc], 0x10c
je 0x1158b8b
mov eax, dword [esi + 4]
test eax, eax
je 0x1158b8b
jl 0x1158c89
mov edi, ebx
cmp ebx, eax
jb 0x1158b5c
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x1158c30
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.01159482
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x1158c20
cmp ebx, dword [ebp - 0xc]
jb 0x1158bf8
cmp dword [ebp - 0xc], 0
je 0x1158bb5
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x1158baa
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x1158bb1
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x1158bc0
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x1158bc0
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x1158c5c
push eax
push dword [ebp - 8]
push esi
call fcn.0115b9d9
pop ecx
push eax
call fcn.0115b8dc
add esp, 0xc
test eax, eax
je 0x1158c9b
cmp eax, 0xffffffff
je 0x1158c89
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x1158c20
push esi
call fcn.0115b1ef
pop ecx
cmp eax, 0xffffffff
je 0x1158c8d
cmp dword [ebp - 4], 0
je 0x1158c5c
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x1158b3e
mov eax, dword [ebp + 0x14]
jmp 0x1158ad8
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x1158c47
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0115ba10
add esp, 0xc
call fcn.0115a8c2
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x1158ace
cmp dword [ebp + 0xc], 0xffffffff
je 0x1158c72
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0115ba10
add esp, 0xc
call fcn.0115a8c2
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x1158ace
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x1158ad8
or dword [esi + 0xc], 0x10
jmp 0x1158c8d
Function at 0x402f4d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
and dword [ebp - 8], 0
push edi
lea edi, [ecx + eax]
push 2
push 0
push edi
mov esi, 0xffff
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], edi
call ebx
cmp eax, 0xffffffff
je 0x402fa6
cmp edi, esi
jae 0x402f8a
mov dword [ebp - 4], edi
push 4
mov edi, 0x404
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x402fad
xor eax, eax
jmp 0x40305b
push 4
pop eax
cmp dword [ebp - 4], eax
jbe 0x403048
jmp 0x402fc3
mov eax, dword [ebp + 0x10]
mov edi, 0x404
mov ecx, dword [ebp - 4]
add eax, 0x400
cmp eax, ecx
mov dword [ebp + 0x10], ecx
ja 0x402fd5
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov esi, eax
sub esi, dword [ebp + 0x10]
sub eax, esi
cmp eax, edi
ja 0x402fe5
mov edi, eax
push 0
push 0
push esi
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
je 0x403048
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x403048
lea eax, [edi - 3]
mov ecx, eax
dec eax
test ecx, ecx
jle 0x40303c
mov ecx, dword [ebp + 0xc]
cmp byte [eax + ecx], 0x50
jne 0x40300e
cmp byte [eax + ecx + 1], 0x4b
jne 0x40300e
cmp byte [eax + ecx + 2], 5
jne 0x40300e
cmp byte [eax + ecx + 3], 6
jne 0x40300e
add eax, esi
test eax, eax
mov dword [ebp - 8], eax
jne 0x403048
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x10], eax
jb 0x402fbb
push EnableWindow
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404792
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x40eb08
mov dword [0x40e9dc], eax
call fcn.0040680e
mov dword [esp], 0x40e9e8
call fcn.0040680e
xor edi, edi
push edi
call fcn.00405b2a
cmp dword [0x40de64], edi
pop ecx
pop ecx
je 0x404819
mov esi, 0x40ea00
push esi
call fcn.00404002
test eax, eax
pop ecx
jne 0x4047ed
push esi
call fcn.00404560
test eax, eax
pop ecx
jne 0x4047ed
push str.Couldnt_create_output_directory.
call fcn.00403aa1
pop ecx
jmp 0x40485b
push edi
call fcn.00405282
pop ecx
call fcn.004061e3
cmp dword [0x40de5c], edi
je 0x404812
push 5
push edi
push edi
push esi
push str.explore
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.00403a68
jmp 0x40485b
mov esi, str.Tahoma
push esi
call fcn.004040d0
test eax, eax
pop ecx
je 0x40482c
push esi
jmp 0x404831
push 0x40a414
push 0x40de70
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
push 0x404a4d
push edi
push 0x66
push dword [0x40e9dc]
mov dword [0x40e9d4], 0xd
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 1
pop eax
pop edi
pop esi
ret 0x10
Function at 0x4066f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41596b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4049cc
call fcn.00407351
push 4
mov dword [esp + 0x18], 0
call fcn.00408087
mov edi, eax
add esp, 4
test edi, edi
je 0x406764
push ebx
call fcn.00407229
mov dword [edi], eax
call fcn.00406fe8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407312
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406758
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040733a
pop ebx
jmp 0x406766
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408b01
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419510]
jne 0x408b0b
repz ret
jmp fcn.0040cd0c
Function at 0x410e23
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040aec6
and dword [ebp - 0x14], 0
cmp dword [0x4307f0], 0
mov dword [ebp - 0x18], eax
jne 0x410ed6
push 0x4038dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410f7e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038d0
push ebx
call edi
test eax, eax
je 0x410f7e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038c0
push ebx
mov dword [0x4307f0], eax
call edi
push eax
call esi
push 0x4038ac
push ebx
mov dword [0x4307f4], eax
call edi
push eax
call esi
push 0x403890
push ebx
mov dword [0x4307f8], eax
call edi
push eax
call esi
mov dword [0x430800], eax
test eax, eax
je 0x410ed6
push 0x403878
push ebx
call edi
push eax
call esi
mov dword [0x4307fc], eax
mov eax, dword [0x4307fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410f2f
cmp dword [0x430800], ecx
je 0x410f2f
push eax
call esi
push dword [0x430800]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410f2f
test ebx, ebx
je 0x410f2f
call edi
test eax, eax
je 0x410f26
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410f26
test byte [ebp - 8], 1
jne 0x410f2f
or dword [ebp + 0x10], 0x200000
jmp 0x410f62
mov eax, dword [0x4307f4]
cmp eax, dword [ebp - 0x18]
je 0x410f62
push eax
call esi
test eax, eax
je 0x410f62
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410f62
mov eax, dword [0x4307f8]
cmp eax, dword [ebp - 0x18]
je 0x410f62
push eax
call esi
test eax, eax
je 0x410f62
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4307f0]
call esi
test eax, eax
je 0x410f7e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410f80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408b01
leave
ret
Function at 0x4135a0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.00411990
cmp dword [0x7b458c], 0x37
jne 0x41363a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7b5580]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4355dc]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x4138c0
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b458c]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x4355dc]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x413abf
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x4138f6
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b458c], 0x1c
jne 0x41390d
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42c458]
mov ebx, dword [0x42c460]
mov ebp, dword [0x42c464]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42c45c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x413956
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b44fc], edi
mov eax, dword [esp + 0x1c]
add dword [0x7b44fc], eax
mov eax, dword [0x7b44fc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b458c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x4139ed
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b458c], 0x979
mov dword [0x7b4500], 0xff6b3619
mov dword [0x7b4504], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x413a37
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x7b458c]
cmp eax, 0x93
je 0x413a5d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x413950
cmp eax, 0x8d4
jne 0x413a74
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b458c], 0x17
jne 0x413aae
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404080
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x4138f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408957
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
add eax, 0x57c9623
sub edi, 0x3a64d10a
call fcn.00408986
xor dword [ecx], edx
add eax, 0xed00e155
inc ecx
and edi, edi
sub eax, 0x7fb454e6
cmp ecx, ebx
jne fcn.00408957
sub eax, edi
inc eax
ret
Function at 0x4024a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x517797
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x577690]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x561800
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00403530
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.00404010
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x57bc74]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x404010
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x51671b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x577690]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004f8a18
push 4
mov dword [esp + 0x20], 0
call fcn.004f9f0e
mov edi, eax
add esp, 4
test edi, edi
je 0x40408e
call fcn.004f8819
mov dword [edi], eax
call fcn.004f8647
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004f8969
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404083
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004f8991
jmp 0x404090
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x404c50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov eax, dword [0x577690]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
xor ebx, ebx
push 0x1ff
lea eax, [esp + 0xd]
push ebx
push eax
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], bl
call fcn.004fc930
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push ebx
push ebx
push 0x8023
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
test eax, eax
jne 0x404cc6
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404cb0
sub eax, edx
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00403d20
mov ecx, dword [esp + 0x208]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.004f8e7f
add esp, 0x208
ret