joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3c70a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x422014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x5150129
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x3c7289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x3c7289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.003f40f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x5150234
nop
test eax, eax
je 0x3c7289
push 4
push 0x1000
push 4
push 0
call 0x5140ddb
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x5130006
nop
test eax, eax
je 0x3c7289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x418df8
push dword [esp + 0x30]
call 0x51303a8
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x3c71ac
push 0x418dfc
push 0x418e14
call 0x5140ab2
nop
push eax
call 0x51300e5
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x51302bb
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x3c7289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x5150000
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x3c7243
mov dword [esp + 0xc], eax
call fcn.003c6ef0
push eax
call 0x5140a0a
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x5150000
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x3c71f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x5150000
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x513051d
nop
push dword [esp + 0x24]
call 0x5140b6d
nop
push 0x8000
push 0
push esi
call 0x5140e7d
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.003dcff1
mov esp, ebp
pop ebp
ret
Function at 0x3caf20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x422014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.003f8b63
push eax
call fcn.003f6660
add esp, 8
call fcn.003f663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.003f663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.003f663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.003c45b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x3cafd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x3cafe6
push 0x40
push 0
push 0x428560
sub esi, ecx
call fcn.003f40f0
add esp, 0xc
mov dword [0x428554], 0
mov edx, esi
mov dword [0x428550], 0
lea ecx, [ebp - 0x410]
mov dword [0x428540], 0x67452301
mov dword [0x428544], 0xefcdab89
mov dword [0x428548], 0x98badcfe
mov dword [0x42854c], 0x10325476
call fcn.003c5530
call fcn.003c55f0
mov ecx, 0x4265a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3cb071
sub ecx, edx
push ecx
push 0x4265a0
lea ecx, [ebp - 0x42c]
call fcn.003d80c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x3cb0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3cb0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3cb18c
push edx
push ecx
call fcn.003dd663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x3cb187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.003d80c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x3cb169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3cb15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3cb18c
push edx
push ecx
call fcn.003dd663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.003dcff1
mov esp, ebp
pop ebp
ret
call fcn.003d8200
call fcn.003f6c6a
int3
Function at 0x3ddcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x5160db6
nop
test eax, eax
je 0x3ddd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x3ddd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3ddd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x3ddd07
cmp dword [ecx + 0x74], 0xe
jbe 0x3ddd07
cmp dword [ecx + 0xe8], 0
je 0x3ddd07
mov al, 1
ret
xor al, al
ret
Function at 0x401037
Capabilities:
Terminate process

Disassembly:
imul esi, dword [edx + 0x6c], 0x754e7064
add byte [eax], al
add bh, ch
add byte [eax + 0x75], bl
imul esp, dword [ecx + 0x64], 0x79
insd dword es:[edi], dx
jns 0x4010a3
jns 0x401035
add byte [eax], al
mov eax, dword [esp + 8]
sub esp, 8
je 0x401054
add esp, 8
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
inc ecx
mov edi, dword [ebp - 0x38]
jge 0x40101e
dec edi
xor eax, dword [ebp]
add edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x18]
push ecx
push edx
push 0
xor esi, dword [ebp - 0x30]
push 0
push 0
call dword [sym.imp.kernel32.dll_OpenMutexA]
pop edx
pop ecx
mov ebx, dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov dword [ebp - 8], eax
jmp 0x401088
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x18], ebx
jnp 0x40109b
pop ebp
call 0x479ba1
add byte [eax], al
inc ebx
mov dword [ebp - 0x28], eax
sub edx, dword [ebp - 0x10]
cmp dword [ebp - 0x30], esi
jns 0x4010a7
add byte [ebx + 0x4e9e85d], cl
add byte [eax], al
add byte [esi - 0x77], al
jge 0x40108c
mov ebx, dword [ebp - 0x18]
jmp 0x4010b0
mov esi, dword [ebp - 0x30]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
push ecx
push edx
push esp
push edi
push eax
cmp byte [ebp - 0x18], bl
jl 0x4010d1
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x18]
push 0
call dword [sym.imp.user32.dll_SendMessageA]
pop edx
pop ecx
sub eax, edx
mov eax, dword [ebp - 0x10]
cmp eax, 0x57
je 0x401158
cmp dword [ebp - 0x10], edx
jns 0x4010fa
mov ecx, esi
add edi, ecx
mov eax, esi
xor edx, dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0x7256ad7c
pop ebx
mov edx, dword [ebp - 0x10]
mov esi, 0x409883
cmp edi, ecx
jne 0x401170
add edi, edx
xor edx, dword [ebp - 0x10]
mov eax, 0x1884
cmp byte [ebp - 0x38], bh
jle 0x401185
dec ecx
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x38]
add edx, dword [ebp - 0x10]
cmp byte [ebp - 0x38], bh
jo 0x40119d
dec ecx
inc edx
inc ecx
mov dword [ebp - 0x1c], eax
inc edx
mov ecx, esi
mov dword [ebp - 0x2c], eax
jmp 0x4011a8
dec ecx
dec edi
sub ecx, edx
sub dword [esi], ebx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
inc ecx
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x38]
sub ebx, 0xf9ad6aa4
mov dword [ebp - 0x18], eax
mov edx, eax
dec esi
add edi, ecx
Function at 0x5f2313
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x845a9f6b
loopne 0x5f2336
arpl bp, di
invalid

Function at 0x5f8e91
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f8eac
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124be0d1]
pop edx
test eax, eax
je 0x5f8f7e
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f8f6d
test dword [ebp - 0x2a8], 1
jne 0x5f8f6d
and dword [ebp - 0x2a8], 0x100
jne 0x5f8f6d
push esi
push edx
push 4
push esi
call dword [edx + 0x122d37df]
pop edx
pop esi
test eax, eax
je 0x5f8f10
jmp 0x5f8f6d
cmp word [esi], 0x5a4d
jne 0x5f8f6d
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f8f6d
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d38db]
pop edx
test eax, eax
je 0x5f8f6d
lea eax, [ebp - 0x28c]
push eax
call fcn.005f8ded
test eax, eax
jne 0x5f8f66
jmp 0x5f8f6d
mov eax, esi
jmp 0x5f8f7e
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f8eac
pop esi
leave
ret 4
Function at 0x406773
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x40679d
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x441060]
inc edi
sub esi, 1
jne 0x406785
pop edi
mov eax, edx
pop esi
ret 0xc

Function at 0x40698a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xor ebp, ebp
cmp dword [edi], 2
lea esi, [edi + 4]
jne 0x4069e0
mov eax, dword [esi]
push ebx
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push dword [esp + 0x5c]
call fcn.00407074
mov edx, ebp
mov ebx, ebp
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebx
inc edx
mov ebx, eax
cmp edx, 0x20
jb 0x4069c4
mov dword [esi], eax
pop ebx
cmp dword [edi], 3
jne 0x406a0c
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push 0x20
push esi
push 0x20
push dword [esp + 0x58]
call fcn.00407074
push 0x20
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00422c30
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x24
ret 8
Function at 0x4102e8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov ebp, ecx
lea eax, [esp + 0x1c]
push edi
push 0x20
push dword [esp + 0x48]
mov esi, dword [ebp + 4]
sub esi, 6
mov dword [esp + 0x18], ebp
push eax
mov dword [esp + 0x24], esi
call fcn.00422c30
add esp, 0xc
xor ebx, ebx
xor edx, edx
xor edi, edi
test esi, esi
jle 0x410368
cmp ebx, dword [ebp + 4]
jg 0x4104cc
cmp edi, esi
jge 0x410355
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x410351
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x410331
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x41035b
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x41031c
cmp ebx, dword [ebp + 4]
jg 0x4104cc
mov edi, 0x440198
movzx eax, byte [esp + esi*4 + 0x1d]
mov cl, byte [esp + 0x20]
xor cl, byte [eax + 0x440098]
mov byte [esp + 0x20], cl
movzx eax, byte [esp + esi*4 + 0x1e]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x21], al
movzx eax, byte [esp + esi*4 + 0x1f]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x22], al
movzx eax, byte [esp + esi*4 + 0x1c]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x23], al
mov al, byte [edi]
xor al, cl
inc edi
mov byte [esp + 0x20], al
mov dword [esp + 0x1c], edi
cmp esi, 8
je 0x4103f9
cmp esi, 1
jle 0x4103ed
lea eax, [esi - 1]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], eax
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x4103db
sub dword [esp + 0x14], 1
jne 0x4103d8
xor edi, edi
test esi, esi
jle 0x4104bf
jmp 0x410477
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 3
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x410408
sub dword [esp + 0x14], 1
jne 0x410405
movzx eax, byte [esp + 0x2c]
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 3
mov al, byte [eax + 0x440098]
xor byte [esp + 0x30], al
movzx eax, byte [esp + 0x2d]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x31], al
movzx eax, byte [esp + 0x2e]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x32], al
movzx eax, byte [esp + 0x2f]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x33], al
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x410465
sub dword [esp + 0x14], 1
jne 0x410462
cmp ebx, dword [ebp + 4]
jg 0x4104c2
cmp edi, esi
jge 0x4104ac
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x4104a8
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x410488
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x4104b2
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x410477
cmp ebx, dword [ebp + 4]
mov edi, dword [esp + 0x1c]
jle 0x410376
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x410686
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44a1f8]
test esi, esi
jne 0x4106a4
mov ecx, 0x44a1f0
call fcn.00410611
mov esi, dword [0x44a1f8]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0x14]
and eax, 0xfffffff0
cmp byte [ebp + 0x10], 0
je 0x4106ef
test esi, esi
je 0x410713
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x434278]
call esi
test eax, eax
jne 0x410737
push 0x434b64
mov esi, 0x4430c4
push esi
call fcn.004076c9
pop ecx
pop ecx
mov ecx, esi
call fcn.00407851
push 2
mov ecx, esi
call fcn.004076c4
jmp 0x410737
mov esi, dword [0x44a1fc]
test esi, esi
je 0x410713
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x434278]
call esi
test eax, eax
jne 0x410737
push 0x434b98
jmp 0x4106d0
push ebx
call dword [0x434058]
xor edx, edx
mov ebx, eax
cmp dword [ebp + 0xc], edx
jbe 0x410736
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x4b]
add al, dl
lea ecx, [edx + esi]
xor byte [ecx], al
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x410726
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x4209cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x434088]
test eax, eax
je 0x420a0a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420a0a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420a0a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420a0a
cmp dword [ecx + 0x74], 0xe
jbe 0x420a0a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4013a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea eax, [edi + eax + 1]
push eax
call fcn.00402e6d
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
mov dword [ebp - 0x58], 0x44
pop ecx
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40b0e8
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x401453
cmp dword [ebp + 0x10], ebx
je 0x401443
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4017bf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x12c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x35c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x35c]
push 0x40b0ec
push eax
call fcn.00402a07
pop ecx
lea eax, [ebp - 0x35c]
pop ecx
mov esi, str.Caption
push eax
lea eax, [ebp - 0x258]
push 0x12c
push eax
push 0x40de38
lea eax, [ebp - 0x12c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x40184f
lea eax, [ebp - 0x12c]
push str.0x0409
push eax
call ebx
lea eax, [ebp - 0x12c]
push eax
push 3
push 0x40e35c
push esi
call fcn.0040196b
lea eax, [ebp - 0x12c]
push eax
push 4
push 0x40e488
push str.Cancel
call fcn.0040196b
lea eax, [ebp - 0x12c]
push eax
push 5
push 0x40e5b4
push str.LocalLaunch
call fcn.0040196b
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 8
push eax
push str.Copying
call fcn.0040196b
add esp, 0x40
lea eax, [ebp - 0x258]
mov esi, 0x40e6e0
push eax
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 0xa
push eax
push 0x40b12c
call fcn.0040196b
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
push esi
call edi
push 0x40b128
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 9
push eax
push str.Scanning
call fcn.0040196b
add esp, 0x10
lea eax, [ebp - 0x258]
mov esi, 0x40e80c
push eax
push esi
call ebx
push 0x40b128
push esi
call fcn.004031d0
lea eax, [ebp - 0x12c]
push eax
push 6
push 0x40e938
push str.PrepMessage
call fcn.0040196b
lea eax, [ebp - 0x12c]
push eax
push 7
push 0x40ea64
push str.WaitMessage
call fcn.0040196b
add esp, 0x28
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c49
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401d35
mov esi, 0x40eb90
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00402bf3
pop ecx
test eax, eax
pop ecx
je 0x401d35
push 0x40b170
push 0x69
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
je 0x401d35
cmp edi, ebx
je 0x401d35
cmp eax, ebx
je 0x401d35
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov esi, eax
cmp esi, ebx
je 0x401d31
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401d28
cmp dword [ebp - 4], esi
jne 0x401d28
push 1
pop esi
jmp 0x401d2a
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x401d37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401dd6
Capabilities:
Delete file

Disassembly:
cmp byte [0x40eb90], 0
push esi
je 0x401e02
xor esi, esi
push 0x40eb90
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401e02
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x401de2
pop esi
ret
Function at 0x401f7e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
cmp dword [0x40edb4], 0
jne 0x402099
and byte [ebp - 0x104], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a91
lea eax, [ebp - 0x104]
push eax
call fcn.00401ecf
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push 0x40b174
push eax
call edi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402099
cmp dword [0x40edb4], 0
jne 0x402092
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a91
pop ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x402060
cmp byte [ebp - 0x218], 0x2e
je 0x40207c
lea eax, [ebp - 0x104]
push eax
call fcn.00401f7e
pop ecx
jmp 0x40207c
inc dword [0x40eda8]
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00402d59
add dword [0x40edac], eax
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40200d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret