joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409411
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push 0xf003f
push edi
push str.SoftwareDownloadManager
push 0x80000001
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4094ca
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
push dword [ebp + 8]
push edi
push edi
push str.ExePath
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4094ca
push dword [ebp + 8]
lea eax, [ebp - 0x41c]
push eax
call sub.MSVCRT.dll_wcscpy
push 0x5c
push dword [ebp + 8]
call sub.MSVCRT.dll_wcsrchr
add esp, 0x10
cmp eax, edi
je 0x40948a
mov word [eax], di
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7e
push dword [ebp + 8]
call sub.MSVCRT.dll_wcschr
pop ecx
test eax, eax
pop ecx
je 0x4094ac
push dword [ebp + 8]
call fcn.00409081
pop ecx
push dword [ebp + 8]
call fcn.004091f4
test al, al
pop ecx
jne 0x4095bf
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call esi
test eax, eax
jne 0x409585
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push str.ProgramFilesDir
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x409514
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x409585
lea eax, [ebp - 0x214]
push 0x7e
push eax
call sub.MSVCRT.dll_wcschr
pop ecx
test eax, eax
pop ecx
je 0x409543
lea eax, [ebp - 0x214]
push eax
call fcn.00409081
pop ecx
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcslen
cmp word [ebp + eax*2 - 0x216], 0x5c
pop ecx
mov eax, 0x4150b8
jne 0x409565
mov eax, 0x41c4f4
push 0x419058
push eax
lea eax, [ebp - 0x214]
push eax
push str._s_s_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x4095bf
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4095c3
lea eax, [ebp - 0x214]
push 0x419058
push eax
push str._sProgram_Files_s
push dword [ebp + 8]
mov word [ebp - 0x20e], di
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor eax, eax
jmp 0x4095c6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aadc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
push 0x419d90
push eax
mov dword [ebp - 8], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40aba0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40aba0
push dword [ebp + 0xc]
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40ab99
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40ab92
test ebx, ebx
je 0x40ab92
push dword [ebp + 0xc]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40ab87
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040aba9
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
jmp 0x40aba2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40b7f3
Capabilities:
Create thread
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
call fcn.0040c088
mov eax, dword [0x41cdd8]
test eax, eax
jne 0x40b80f
mov eax, 0x41cddc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40d19d
push 0x6b
push eax
push ebx
call fcn.0040bb14
add esp, 0x10
lea eax, [ebp - 0x45c]
push 0x41d424
push 0x417374
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
lea eax, [ebp - 0x254]
push eax
push edi
call esi
and dword [0x41de64], 0
lea eax, [ebp - 0x254]
push eax
push edi
call esi
test eax, eax
je 0x40b889
mov eax, dword [ebp - 0x234]
add dword [0x41de64], eax
jmp 0x40b86d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebx]
push 0x404512
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x41de74], eax
jne 0x40b8cd
push 0x4150b0
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_call_CreateThread_in_ShowInstalling
call fcn.004063d0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x40b9b8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x41cfd8]
test eax, eax
jne 0x40b9c6
mov eax, 0x41cfdc
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x40d19d
push 0x72
push eax
push esi
call fcn.0040bb14
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x10
push 0x3f0
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3f1
push dword [esi]
call edi
push 5
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40ba0c
Capabilities:
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0xf003f
push eax
xor esi, esi
push ebx
push esi
push str.SoftwareDownloadManagerConfigTime
push 0x80000001
call edi
test eax, eax
jne 0x40ba5c
lea eax, [ebp - 0xc]
or dword [ebp - 0xc], 0xffffffff
push 4
push eax
push 4
push esi
push 0x41c4f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push ebx
push esi
push str.SoftwareInternet_Download_Manager
push 0x80000002
call edi
push 1
test eax, eax
pop ebx
jne 0x40ba98
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push esi
push str.InstallStatus
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040c088
mov eax, dword [0x41cfd8]
cmp eax, esi
jne 0x40baab
mov eax, 0x41cfdc
mov edi, dword [ebp + 8]
push 0x40d19d
push 0x73
push eax
push edi
call fcn.0040bb14
add esp, 0x10
push 0x3ef
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 0x10]
push eax
push esi
push dword [edi]
push 0x40d768
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x41de78], eax
jne 0x40bb0d
push 0x4150b0
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_call_CreateThread_in_uninstaller
call fcn.004063d0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x40c088
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
call fcn.0040c04b
call fcn.0040b490
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40c0e2
lea eax, [ebp - 8]
push eax
push str.IDMan.exe
call fcn.0040bbea
pop ecx
test eax, eax
pop ecx
je 0x40c0e2
push dword [ebp - 8]
push 0
push 1
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40c0e2
push 0
push eax
call edi
push dword [ebp - 4]
call ebx
lea eax, [ebp - 8]
push eax
push str.IDMIntegrator64.exe
call fcn.0040bbea
pop ecx
test eax, eax
pop ecx
je 0x40c110
push dword [ebp - 8]
push 0
push 1
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40c110
push 0
push eax
call edi
push dword [ebp - 4]
call ebx
lea eax, [ebp - 8]
push eax
push str.idmBroker.exe
call fcn.0040bbea
pop ecx
test eax, eax
pop ecx
je 0x40c13e
push dword [ebp - 8]
push 0
push 1
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40c13e
push 0
push eax
call edi
push dword [ebp - 4]
call ebx
lea eax, [ebp - 8]
push eax
push str.IDMGrHlp.exe
call fcn.0040bbea
pop ecx
test eax, eax
pop ecx
je 0x40c16c
push dword [ebp - 8]
push 0
push 1
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40c16c
push 0
push eax
call edi
push dword [ebp - 4]
call ebx
lea eax, [ebp - 8]
push eax
push str.IEMonitor.exe
call fcn.0040bbea
pop ecx
test eax, eax
pop ecx
je 0x40c197
push dword [ebp - 8]
push 0
push 1
call esi
mov esi, eax
test esi, esi
je 0x40c197
push 0
push esi
call edi
push esi
call ebx
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push str.SoftwareDownloadManager
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c23c
lea eax, [ebp - 4]
xor esi, esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push str.ExePath
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c233
lea eax, [ebp - 0x214]
push 0x5c
push eax
call sub.MSVCRT.dll_wcsrchr
mov edi, eax
pop ecx
cmp edi, esi
pop ecx
je 0x40c233
lea eax, [edi + 2]
push str.IDMan.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40c233
lea eax, [ebp - 0x214]
mov word [edi], si
push eax
lea eax, [ebp - 0x41c]
push str._sIDMan.exe.Local_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x41c]
push eax
call fcn.004109db
add esp, 0x10
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c38d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp + 0x10]
call sub.MSVCRT.dll__wsplitpath
add esp, 0x14
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40c3e5
push str.GetDiskFreeSpaceExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3e5
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
call eax
test eax, eax
je 0x40c420
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
jmp 0x40c410
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40c420
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
xor ecx, ecx
cmp ecx, dword [ebp + 0xc]
jl 0x40c41c
jg 0x40c420
cmp eax, dword [ebp + 8]
ja 0x40c420
xor eax, eax
leave
ret
push 1
pop eax
leave
ret

Function at 0x40cffc
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40d037
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40d01e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40d02f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40d039
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40d014
xor eax, eax
pop edi
pop esi
ret
Function at 0x40d84d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040cfcc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040cf81
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040cfcc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040cf81
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040cfcc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040cf81
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040cfbc
add eax, 0x8079d808
movsd dword es:[edi], dword [esi]
int3
Function at 0x41051c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareDownloadManager
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4105ba
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.CommonAppDataIDMFolder
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4105b1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4105b1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push str._sproxy.pac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x4105bc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x410633
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x410633
lea eax, [ebp - 0x20c]
push 0x4150b8
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x20c]
push str.Internet_Download_Manager.lnk
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret

Function at 0x410965
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push edi
push 0x18b
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, edi
jbe 0x4109d4
lea eax, [ebp - 0x208]
push eax
push edi
push 0x189
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x208]
push 0x419058
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x208]
push eax
je 0x4109c9
call fcn.004109db
pop ecx
jmp 0x4109cf
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc edi
cmp edi, ebx
jb 0x41098e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4109db
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x664]
push 0x417374
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x410ad4
lea eax, [ebp - 0x254]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push eax
push ebx
call esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x254]
push eax
push ebx
call esi
test eax, eax
je 0x410aab
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x45c]
push dword [ebp + 8]
push 0x4156e4
push eax
call edi
mov eax, dword [ebp - 0x254]
add esp, 0x10
and eax, 0x10
cmp al, 0x10
je 0x410a85
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x45c]
push 0x41cd38
push eax
call fcn.00405ef6
jmp 0x410a36
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x45c]
push 0x41c228
push eax
call edi
lea eax, [ebp - 0x45c]
push eax
call fcn.004109db
add esp, 0x10
jmp 0x410a36
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop esi
jne 0x410ad2
push eax
lea eax, [ebp - 4]
push eax
push 0x41cd38
push dword [ebp + 8]
call fcn.00405ef6
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x410bc4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x4150b0
push ebx
call sub.MSVCRT.dll_wcsstr
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 8], eax
je 0x410d01
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp + 8]
cmp word [eax - 2], 0x5c
je 0x410ce2
push 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
sub eax, ebx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x210]
push 0x41c290
push eax
call sub.MSVCRT.dll_wcsstr
add esp, 0x20
test eax, eax
jne 0x410ce2
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_wcslen
test eax, eax
pop ecx
je 0x410ce2
lea eax, [ebp - 0x210]
push eax
push edi
push 0x180
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push edi
push edi
push 3
mov dword [ebp - 4], eax
push edi
push 1
lea eax, [ebp - 0x210]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x410cb6
push 0x4150b0
push edi
lea eax, [ebp - 0x210]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_to_open_file_in_dialogs_FillFileList
call fcn.004063d0
add esp, 0x18
jmp 0x410cc8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 8]
push ebx
push dword [ebp - 4]
push 0x19a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
add dword [0x41e0a8], ebx
mov eax, dword [ebp + 8]
push 0x4150b0
lea ebx, [eax + 4]
push ebx
call sub.MSVCRT.dll_wcsstr
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 8], eax
jne 0x410bf3
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x424c63
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lds eax, [ebx]
or al, byte [ebx - 0x5f]
imul esi, dword [esi + 0x3780dd19], 0xffffffeb
push ebp
push esi
pop ebp
stosd dword es:[edi], eax
imul ebx, dword [ebp + 0x31], 0x67
aad 0x83
and byte ss:[ebp + 3], al
xor dword [ecx + 0x49b583d9], edi
jns 0x424cba
add dword [ebx + 0x55], esp
add eax, 0x5315f157
lahf
mov ch, 0xb3
xor byte [eax - 0x66570638], 0x63
pop edi
push ebx
xor eax, 0x80657026
push ebp
fdivrp st(3)
sti
mov dword [esi + 0x69], edi
cli
and edx, ebp
push es
aad 6
sub eax, 0x55031423
mov ch, 0xb3
add esi, dword [0xd4079573]
and byte [ebp - 3], dl
xor ebp, dword [eax + edx*8]
sub al, 0xd0
mov dh, 0x7e
mov eax, dword [0xe370ff7f]
dec eax
inc esi
or dword [ebx + 0x69], ecx
cmp dl, ah
xchg esi, eax
sar byte [edx], cl
mov bh, 0x59
or al, 0xf5
pop ebx
inc esi
pop es
push 0x5375ad3
xor eax, 0xf0841201
in al, 0x4c
leave
jecxz 0x424ca7
pop ss
inc edx
inc esp
call 0x55e5d611
cmp ecx, dword [ebp + 0x7e1b6c81]
fadd dword [edi - 0x30]
arpl word [ebx - 0x741edbfe], ax
invalid

Function at 0x452e43
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [edi]
fucom st(1)
pushal
dec ebp
adc edx, dword [ebp - 0x40a4a0df]
cmc
jle 0x452e8a
push dword [esi]
mov bh, 0x8d

Function at 0x455942
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx], bh
lahf
and ecx, dword [edx]
xor dword [ecx + 0x28], ebp
dec ecx
salc
add ebp, dword cs:[edx - 0x4b]
add byte [edi + ebp], cl
out 0xa6, al
sbb esp, ebp
test eax, 0xd97a583b
push esp
mov esi, 0x9d44b949
popfd
popfd
movsb byte es:[edi], byte [esi]
xchg ebx, eax
movsd dword es:[edi], dword [esi]
call 0x1c9e8e35
sahf
jp 0x455923
lahf
sbb al, 0xb9
mov edx, 0xba7d6d31
cmp al, 0xb
xchg dword [ebp + 0x2a7e2a91], edi
xchg ecx, eax
invalid
Function at 0x4777d5
Capabilities:
Encode data using xor

Disassembly:
push esi
add word [ebp + 0x6c70846], cx
or cl, bh
add byte [eax], al
push eax
call dword [0x1ba968c]
mov ecx, esi
pop esi
jmp 0x593f46
or ebp, dword [ebx]
aam 0xfb
sbb al, 0x51
int1
popfd
call 0x3c891c2
sal dword [ebx + 0x54], 1
mov word [edi + 0x70ae296b], fs
ror ch, 1
hlt
xchg ebx, eax
lds ebx, [ebp + ecx*2 + 0x11]
popfd
jp 0x593f73
mov ebx, dword [ebp - 0x32d8c59d]
ljmp 0xbd13
mov dword [0xe7619a54], eax
sub eax, 0xba3ae7a9
cmp eax, 0xc5d0769f
jge 0x593f8c
xor eax, 0x89716dae
scasb al, byte es:[edi]
insd dword es:[edi], dx
jno 0x593ee4
inc edi
jl 0x593fae
fisubr dword [edx - 0x73]
test byte [edx], bh
xor eax, 0x3ca546e8
ficomp word [esi - 0x1c]
enter 0x616, 0x22
sbb dword [edx + edx + 0x291b2526], ebx
retf
adc ah, byte [esi]
and eax, 0xc8cb291b
mov byte es:[0xde2181de], al
push eax
jecxz 0x593f71
push ds
or eax, 0xf06b9766
jnp 0x593f7e
mov cl, 0x46
inc edi
test byte [ebx + 0x11], 0x5f
pop edx
aaa
fsub st(7), st(0)
into
jl 0x593f56
inc ebp
int 0xc
int 0x7e
je 0x593f29
out dx, eax
pop edx
push es
sub edx, esp
xor dword [ebp - 0x49], esp
fcomp st(4)
int1
iretd
inc esp
jecxz 0x593f6b
xchg esi, eax
aam 0x3d
std
pop eax
clc
mov cl, 0x7f
pop esi
mov esi, 0xf7f8b3a6
mov cl, 0x23
stosb byte es:[edi], al
push esp
out dx, al
jne 0x593fb2
mov gs, word [eax]
mov es, word [ecx - 0x5f]
test dword [ecx + edi + 0x40], edi
pushal
test byte [ebp + 0x32], ah
inc ebp
mov al, byte [0xe0d3bff0]
mov bh, 0x96
mov eax, dword [0x9ab09009]
push edx
jecxz 0x594014
out dx, al
mov edx, dword [ebp + esi - 0x4c]
xchg esp, eax
adc cl, dl
xor ch, ch
leave
invalid
int 0xc6
call 0x6bc2f88f
xchg esi, eax
sub al, 0x90
in eax, 0x97
invalid