joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440c40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440c73
push esi
call fcn.0044f000
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x440c6c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x440cf9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x440ce2
mov eax, dword [esi + 8]
test eax, eax
je 0x440c97
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x440cde
cmp eax, 2
je 0x440ce2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x440c8a
cmp eax, 3
je 0x440cbd
cmp eax, 1
jne 0x440c8a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x440c8a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x440c8a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00440d20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x440d08
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00440d20
add esp, 4
pop esi
ret

Function at 0x4415a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4415c1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4415c1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4415c1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46f047
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46f07f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046d0fb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046d0d3
jmp 0x46f08b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x470735
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x470777
call fcn.004761e9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x470777
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47076e
xor eax, eax
jmp 0x47077f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00470785
pop edi
pop esi
pop ebx
ret 4
Function at 0x476719
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x476747
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x476765
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047667f
jmp 0x476765
mov eax, dword [esi + 0x14]
test eax, eax
je 0x476765
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047667f
test edi, edi
mov eax, edi
jne 0x47674f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40288e
pop dword [ebp - 0x38]
mov eax, 0x7245a4af
sub eax, 0x72057c21
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x9317ff70
sub dword [ebp - 0x48], 0x44c5ba25
mov dword [ebp - 0x44], 0xbb7fb0d5
add dword [ebp - 0x44], 0x76b39b70
mov dword [ebp - 0x40], 0x752c7330
sub dword [ebp - 0x40], 0x28e02f02
mov dword [ebp - 0x3c], 0xd7e4cd7f
sub dword [ebp - 0x3c], 0xd7e4cd7f
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe10e13a7
sub eax, 0xe0cda343
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x1b648db0
add dword [ebp - 0x48], 0x590ddba6
mov dword [ebp - 0x44], 0x7f03242a
add dword [ebp - 0x44], 0xc2693d4b
mov dword [ebp - 0x40], 0x9f478752
add dword [ebp - 0x40], 0xc427e51a
mov dword [ebp - 0x3c], 0x5005b5a4
sub dword [ebp - 0x3c], 0x5005b5a4
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xdc2e2bd2
add eax, 0x241244d6
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39e66
push 0
call eax
mov ecx, 0x5537
xor edx, edx
add edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x38]
mov ebx, 0x4c6197ed
add ebx, 0x4582816
sub dword [ebp - 0x18], 0xc8c8d10c
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0x7e16bb43
sub edi, ebx
sub dword [ebp - 0x10], edi
mov dword [edx], edi
add dword [ebp - 0x28], ecx
add edx, 4
add esi, 0xc39d35c5
sub esi, 0xc39d35c1
loop 0x4029a6
add eax, 0xbf8462ab
sub eax, 0xbf831afc
xor ebx, ebx
add ebx, eax
add eax, 0x63d11269
sub eax, 0x63d11264
mov ecx, 0xb1b5a1f1
sub ecx, 0xb175a1f1
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4027c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402858
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402838
xor eax, eax
push ebp
push 0x402831
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402874
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402838
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404ab8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c70
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404b19
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c8c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b86
xor eax, eax
push ebp
push 0x404b7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b68
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404cac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b86
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c67
cmp byte [ebp - 0xd], 0
jne 0x404bc8
cmp byte [ebp - 0x12], 0
je 0x404c67
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404be1
dec ebx
cmp byte [ebx], 0x2e
je 0x404bf0
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404be0
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c67
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404c1d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c67
cmp byte [ebp - 0xd], 0
je 0x404c67
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c67
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406da4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406eae
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x406df7
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403240
jmp 0x406e95
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406d58
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406d78
mov ebx, eax
test esi, esi
je 0x406e1f
dec esi
test esi, esi
jl 0x406e1f
cmp edi, ebx
jne 0x406dfe
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403280
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004034cc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c8
cmp eax, 2
jl 0x406e95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406e95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c8
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406e95
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004032c8
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004034cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406eb5
lea eax, [ebp - 0x110]
call fcn.0040315c
ret

Function at 0x406f28
Capabilities:
Get file attributes

Disassembly:
call fcn.00405f18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x406f3c
dec eax
and al, 0x10
sete al
ret
Function at 0x40703c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040347c
mov eax, dword [ebp - 8]
call fcn.0040347c
xor eax, eax
push ebp
push 0x40718c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040315c
cmp dword [ebp - 4], 0
je 0x4070a4
mov eax, dword [ebp - 4]
call fcn.004032c8
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4070a4
lea eax, [ebp - 4]
mov edx, 0x4071a4
call fcn.004032d0
cmp dword [ebp - 8], 0
je 0x4070d3
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x4070d3
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00406c94
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.004031f4
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403314
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040348c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x40715c
test dword [ebp - 0x14c], 0x10
ja 0x407149
cmp dword [ebx], 0
je 0x40711c
mov eax, ebx
mov edx, 0x4071b0
call fcn.004032d0
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004032b0
push dword [ebp - 0x150]
mov eax, ebx
mov edx, 3
call fcn.00403388
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4070ff
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407193
lea eax, [ebp - 0x150]
call fcn.0040315c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403180
ret

Function at 0x4071b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4072a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004032c8
mov ebx, eax
lea eax, [ebx + 2]
call fcn.0040252c
mov esi, eax
mov eax, edi
call fcn.0040348c
mov edx, eax
mov eax, esi
call fcn.00406bd0
mov byte [esi + ebx + 1], 0
cmp ebx, 0
jl 0x40720f
cmp byte [esi + ebx], 0x3b
jne 0x407209
mov byte [esi + ebx], 0
dec ebx
cmp ebx, 0xffffffff
jne 0x4071ff
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004026f0
cmp dword [0x426500], 0
je 0x407232
mov eax, dword [0x426500]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe], 0x50
mov dword [ebp - 0xc], 0xffffffff
push 0x4072c0
push edi
push 0x4072d0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403388
mov eax, dword [ebp - 0x24]
call fcn.0040348c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
test bl, bl
je 0x407288
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
sbb ebx, ebx
neg ebx
mov eax, esi
call fcn.00402544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072ac
lea eax, [ebp - 0x24]
call fcn.0040315c
ret
Function at 0x407344
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0040348c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete al
pop ebp
ret

Function at 0x407400
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x42545c]
mov byte [eax], 1
mov edx, dword [0x405e08]
xor eax, eax
call fcn.00406048
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x4073f0
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x407490
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x4074ab
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x4074ba
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x407518
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret
Function at 0x409118
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x409127
mov edx, dword [edx + 0x36]
jmp fcn.00403280
mov ecx, dword [edx + 0x18]
jecxz 0x40911f
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.004035f8
pop edx
mov ecx, dword [ebx]
jecxz 0x40914f
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x4091c0
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x4091cc
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x4091e8
push eax
je 0x4091e9
call dword [0x42518c]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x42518c]
ret
Function at 0x416ec8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x248], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x417129
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x144]
mov ecx, 0x417140
mov edx, edi
call fcn.00403314
mov eax, dword [ebp - 0x144]
call fcn.0040348c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x417105
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x114]
call fcn.00402710
lea eax, [ebp - 0x244]
mov edx, 0x417144
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402680
je 0x4170e4
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
call fcn.00403280
mov eax, dword [ebp - 0x144]
mov edx, 0x417150
call fcn.004033d8
je 0x4170e4
test byte [ebp - 0x140], 0x10
je 0x417014
cmp byte [ebx + 0x1f], 0
jbe 0x416fbd
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.00416d6c
cmp byte [ebx + 0x1c], 0
jne 0x4170e4
push edi
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
push dword [ebp - 0x248]
push 0x41715c
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.00403388
mov edx, dword [ebp - 0x144]
mov eax, ebx
call fcn.00416ec8
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
jmp 0x4170e4
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x144]
call fcn.00406c6c
mov eax, dword [ebp - 0x144]
mov edx, dword [ebx + 0xc]
call fcn.00416b90
test al, al
je 0x417081
inc dword [ebx + 4]
cmp byte [ebx + 0x1f], 1
je 0x4170e4
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.00416d6c
jmp 0x4170e4
cmp byte [ebx + 0x1e], 0
je 0x4170c0
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x144]
mov edx, edi
call fcn.00403314
mov edx, dword [ebp - 0x144]
lea eax, [ebx + 0x58]
call fcn.0040b5d0
jmp 0x4170e4
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004032b0
mov edx, dword [ebp - 0x144]
lea eax, [ebx + 0x58]
call fcn.0040b5d0
cmp byte [ebx + 8], 0
jne 0x4170ff
lea eax, [ebp - 0x140]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x416f32
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417130
lea eax, [ebp - 0x248]
call fcn.0040315c
lea eax, [ebp - 0x144]
call fcn.0040315c
ret
Function at 0x417724
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.0040347c
xor eax, eax
push ebp
push 0x417817
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov al, byte [ebx + 9]
sub al, 1
jb 0x41775a
je 0x417761
jmp 0x417768
mov edi, 0x8003
jmp 0x41776d
mov edi, 0x8004
jmp 0x41776d
mov edi, 0x8004
xor ebx, ebx
push 0xf0000000
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_CryptAcquireContextA
test eax, eax
je 0x4177ed
lea eax, [ebp - 8]
push eax
push 0
push 0
push edi
mov eax, dword [esi]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x4177e6
push 0
mov eax, dword [ebp + 0x14]
call fcn.004032c8
push eax
lea eax, [ebp + 0x14]
call fcn.00403498
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x4177df
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [esi]
push eax
call sub.advapi32.dll_CryptDeriveKey
test eax, eax
jne 0x4177f2
mov ebx, 7
jmp 0x4177f2
mov ebx, 0xb
jmp 0x4177f2
mov ebx, 0xa
jmp 0x4177f2
mov ebx, 3
cmp dword [ebp - 8], 0
je 0x417801
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41781e
lea eax, [ebp + 0x14]
call fcn.0040315c
ret
Function at 0x41bb20
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
je 0x41bb85
mov byte [ebx + 0x28], 0
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 4], eax
pop ebx
ret