joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052ac
Capabilities:
Extract resource via kernel32 functions
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405440
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
test esi, esi
je 0x405314
push 0x405450
push esi
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
je 0x405314
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405314
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x405436
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405354
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405436
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405298
mov esi, eax
cmp byte [esi], 0
je 0x405436
lea eax, [esi + 1]
call fcn.00405298
mov esi, eax
cmp byte [esi], 0
je 0x405436
jmp 0x40535a
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x405419
lea eax, [esi + 1]
call fcn.00405298
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405436
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_ResetEvent
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov esi, eax
cmp esi, 0xffffffff
je 0x405436
push esi
call sub.KERNEL32.DLL_GlobalFindAtomA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ResumeThread
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405436
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_ResetEvent
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405378
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405464
Capabilities:
Read file on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LeaveCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405694
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4054e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405694
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4054e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056b0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x405570
xor eax, eax
push ebp
push 0x405569
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004052ac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40554e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4056d0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40554e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405570
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_MulDiv
push eax
call sub.KERNEL32.DLL_InitializeCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40568a
cmp byte [ebp - 0xd], 0
jne 0x4055b7
cmp byte [ebp - 0x12], 0
je 0x40568a
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4055d0
dec ebx
cmp byte [ebx], 0x2e
je 0x4055df
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4055cf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40568a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40561c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
test esi, esi
jne 0x40568a
cmp byte [ebp - 0xd], 0
je 0x40568a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
test esi, esi
jne 0x40568a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404360
push eax
mov eax, esi
call fcn.00404560
push eax
mov eax, ebx
call fcn.00404360
push eax
mov eax, ebx
call fcn.00404560
push eax
push 0
push 0x400
call sub.user32.dll_GetKeyboardState
sub eax, 2
pop esi
pop ebx
ret

Function at 0x407faa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404360
push eax
mov eax, esi
call fcn.00404560
push eax
mov eax, ebx
call fcn.00404360
push eax
mov eax, ebx
call fcn.00404560
push eax
push 0
push 0x400
call sub.user32.dll_GetKeyboardState
sub eax, 2
pop esi
pop ebx
ret

Function at 0x407fbc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404360
push eax
mov eax, esi
call fcn.00404560
push eax
mov eax, ebx
call fcn.00404360
push eax
mov eax, ebx
call fcn.00404560
push eax
push 1
push 0x400
call sub.user32.dll_GetKeyboardState
sub eax, 2
pop esi
pop ebx
ret

Function at 0x40800c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyboardState
sub eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x408019
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyboardState
sub eax, 2
pop edi
pop esi
pop ebx
ret
Function at 0x40a00c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a15a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004040a0
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40a170
call fcn.00404138
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404560
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_LoadKeyboardLayoutA
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x40a139
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404310
dec esi
jne 0x40a139
mov eax, dword [0x481744]
sub eax, 4
je 0x40a0dc
sub eax, 0xd
jne 0x40a139
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040c6d8
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.004045c0
jmp 0x40a139
cmp dword [0x481748], 1
jne 0x40a139
mov eax, dword [ebx]
call fcn.00404360
mov edx, eax
mov eax, dword [ebx]
call fcn.0040c564
cmp eax, 4
jne 0x40a139
mov eax, dword [ebx]
mov edx, 3
call fcn.0040c674
mov esi, eax
lea eax, [ebp - 0x114]
add esi, eax
dec esi
lea eax, [ebp - 0x118]
mov edx, esi
call fcn.00404298
mov eax, dword [ebp - 0x118]
mov edx, 2
call fcn.0040c6d8
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.00404190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a161
lea eax, [ebp - 0x118]
call fcn.004040a0
lea eax, [ebp - 4]
call fcn.004040a0
ret

Function at 0x40a174
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a252
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004040a0
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40a1d2
lea eax, [ebp - 4]
mov edx, 0x40a268
call fcn.00404138
jmp 0x40a1df
lea eax, [ebp - 4]
mov edx, 0x40a274
call fcn.00404138
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404560
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_LoadKeyboardLayoutA
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x40a23c
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404310
dec esi
jne 0x40a23c
mov eax, dword [ebx]
cmp byte [eax], 0x30
jne 0x40a23c
push ebx
mov eax, dword [ebx]
call fcn.00404360
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.004045c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a259
lea eax, [ebp - 4]
call fcn.004040a0
ret
Function at 0x40c3c4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c49a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404138
lea eax, [ebp - 8]
call fcn.004045b0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404560
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c484
mov eax, ebx
call fcn.004026f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c47d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404560
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c467
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c4ac
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c467
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c484
mov eax, dword [ebp - 0x10]
call fcn.00402714
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4a1
lea eax, [ebp - 8]
call fcn.004040a0
ret

Function at 0x40ca04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40ca9a
cmp byte [esi], 0
je 0x40ca9a
test ebp, ebp
je 0x40ca9a
cmp byte [ebp], 0
je 0x40ca9a
mov eax, esi
call fcn.00408b58
mov dword [esp], eax
mov eax, ebp
call fcn.00408b58
mov edi, eax
mov edx, ebp
mov eax, esi
call fcn.00408cf0
mov ebx, eax
jmp 0x40ca87
mov edx, ebx
sub edx, esi
mov eax, esi
call fcn.0040c54c
mov byte [esp + 4], al
cmp byte [esp + 4], 2
je 0x40ca73
push edi
push ebp
push edi
push ebx
push 0
push 0x400
call sub.user32.dll_GetKeyboardState
cmp eax, 2
je 0x40ca9a
cmp byte [esp + 4], 1
jne 0x40ca7b
inc ebx
inc ebx
mov edx, ebp
mov eax, ebx
call fcn.00408cf0
mov ebx, eax
test ebx, ebx
je 0x40ca98
mov eax, ebx
sub eax, esi
mov edx, dword [esp]
sub edx, eax
cmp edi, edx
jbe 0x40ca48
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41d9b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d9b6
ret
Function at 0x420c00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, ebx
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00420ab0
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x420c9d
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x420c54
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_EnumWindows
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DrawMenuBar
push 0
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CallNextHookEx
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420ca4
cmp dword [ebp - 8], 0
je 0x420c93
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
ret
Function at 0x46206c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46213c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x105
mov eax, ebx
call fcn.00402a50
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10d]
push eax
lea eax, [ebp - 4]
push eax
call sub.user32.dll_GetKeyState
test eax, eax
jne 0x462115
lea edx, [ebp - 0x10d]
mov eax, esi
mov ecx, dword [ebp - 8]
call fcn.00404190
cmp bl, 0x61
jae 0x4620f9
lea edx, [ebp - 0x114]
mov eax, dword [esi]
call fcn.0040c978
mov edx, dword [ebp - 0x114]
mov eax, esi
call fcn.004040f4
jmp 0x46211e
lea edx, [ebp - 0x118]
mov eax, dword [esi]
call fcn.0040c8ec
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.004040f4
jmp 0x46211e
mov edx, esi
mov eax, ebx
call fcn.00461ed0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462143
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.004040c4
ret

Function at 0x469214
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
xor eax, eax
push ebp
push 0x469327
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb4]
push eax
call sub.user32.dll_MapVirtualKeyA
sub eax, 0xffffffff
je 0x469257
dec eax
je 0x469280
dec eax
je 0x469293
dec eax
je 0x469288
jmp 0x46929e
lea edx, [ebp - 0xb8]
mov eax, dword [0x480f38]
call fcn.00405d04
mov ecx, dword [ebp - 0xb8]
mov dl, 1
mov eax, dword [0x46891c]
call fcn.0040bb74
call fcn.00403a58
jmp 0x4692c5
mov ebx, dword [ebp - 0xb4]
jmp 0x4692c5
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0xc]
jmp 0x4692c5
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0x60]
jmp 0x4692c5
lea edx, [ebp - 0xbc]
mov eax, dword [0x480f38]
call fcn.00405d04
mov ecx, dword [ebp - 0xbc]
mov dl, 1
mov eax, dword [0x46891c]
call fcn.0040bb74
call fcn.00403a58
push 0
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, ecx
mov esi, 0x3c
cdq
idiv esi
push edx
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
xor ecx, ecx
pop edx
call fcn.00409af0
fstp qword [ebp - 8]
wait
test ebx, ebx
jle 0x469309
fld dword [0x469338]
fsub qword [ebp - 8]
fstp qword [ebp - 8]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46932e
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.004040c4
ret
Function at 0x402f2e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f5b
mov ecx, dword [0x423fd8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417124], eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403059
cmp eax, edi
jl 0x403052
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x40304f
cmp dword [ebp - 4], esi
jne 0x40304f
push dword [ebp + 8]
add dword [0x417124], esi
call fcn.00403059
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403052
cmp dword [ebp + 0x10], edi
jne 0x40301e
cmp dword [ebp + 8], edi
jle 0x40304a
mov esi, 0x413120
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fce
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x40304f
cmp edi, dword [ebp - 4]
jne 0x40304f
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x40301a
cmp dword [ebp + 0x14], edi
jne 0x40301a
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417124], eax
cmp dword [ebp + 8], 0
jg 0x402fc1
jmp 0x40304a
push 0xfffffffffffffffe
jmp 0x403051
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403029
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x40304f
mov eax, dword [ebp - 4]
add dword [0x417124], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403052
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403059
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417124]
sub esi, dword [0x40b090]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423f8c], eax
jle 0x4031c3
push dword [0x41f134]
call fcn.00403207
push ebx
push ebx
push dword [0x40b090]
push dword [0x409018]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [0x41f130], esi
mov dword [0x417120], ebx
mov ebp, 0x40b120
mov eax, dword [0x417128]
mov edi, 0x4000
sub eax, dword [0x41f134]
cmp eax, edi
jg 0x4030ce
mov edi, eax
mov esi, 0x413120
push edi
push esi
call fcn.004031d5
test eax, eax
je 0x4031b5
add dword [0x41f134], edi
mov dword [0x40b0b0], esi
mov dword [0x40b0b4], edi
cmp dword [0x423f90], ebx
je 0x403125
cmp dword [0x424020], ebx
jne 0x403125
mov eax, dword [0x41f130]
push ebx
sub eax, dword [0x417124]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40b090]
mov dword [0x417120], eax
call fcn.00402be9
pop ecx
mov ecx, 0x40b098
mov dword [0x40b0b8], ebp
mov dword [0x40b0bc], 0x8000
call fcn.00406184
test eax, eax
jl 0x4031be
mov esi, dword [0x40b0b8]
sub esi, ebp
je 0x40317f
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4031ba
cmp esi, dword [esp + 0x10]
jne 0x4031ba
add dword [0x40b090], esi
cmp dword [0x40b0b4], ebx
jne 0x4030f4
jmp 0x40318b
cmp dword [0x40b0b4], ebx
jne 0x4031be
cmp edi, ebx
je 0x4031be
mov eax, dword [0x417124]
mov ecx, eax
sub ecx, dword [0x40b090]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030b8
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x4031c3
or eax, 0xffffffff
jmp 0x4031cd
push 0xfffffffffffffffe
jmp 0x4031c0
push 0xfffffffffffffffd
pop eax
jmp 0x4031cd
push 1
call fcn.00402be9
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4054a9
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x407310
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x407300
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x4054fa
xor eax, eax
jmp 0x405521
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405521
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x4054f6
call esi
pop esi
leave
ret 4

Function at 0x40555b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422588], 0x44
push eax
xor eax, eax
push 0x422588
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x405596
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x405620
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004058cf
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405654
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x424008], eax
jmp 0x4057e8
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405672
test eax, eax
je 0x405793
test byte [ebp + 0xc], 2
je 0x405793
mov esi, 0x421588
push edi
push esi
call fcn.00405cfb
test ebx, ebx
je 0x40568f
push str..
push esi
call sub.KERNEL32.DLL_lstrcatA
jmp 0x405695
push edi
call fcn.00405835
cmp byte [edi], 0
jne 0x4056a3
cmp byte [0x421588], 0x5c
jne 0x4056ae
push 0x409010
push edi
call sub.KERNEL32.DLL_lstrcatA
push edi
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405789
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405819
cmp byte [eax], 0
je 0x4056f4
cmp byte [ebp - 0x18], 0
je 0x4056f4
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40570a
mov al, byte [esi + 1]
test al, al
je 0x405768
cmp al, 0x2e
jne 0x40570a
cmp byte [esi + 2], 0
je 0x405768
push esi
push ebx
call fcn.00405cfb
test byte [ebp - 0x148], 0x10
je 0x40572f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405768
push dword [ebp + 0xc]
push edi
call fcn.00405620
jmp 0x405768
push edi
call fcn.004059b3
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x405760
test byte [ebp + 0xc], 4
je 0x405758
push edi
push 0xfffffffffffffff1
call fcn.00404fe7
push 0
push edi
call fcn.00405a49
jmp 0x405768
inc dword [0x424008]
jmp 0x405768
push edi
push 0xfffffffffffffff2
call fcn.00404fe7
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4056d2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp - 4], 0
je 0x405793
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4057e8
cmp dword [ebp - 8], esi
jne 0x4057a8
inc dword [0x424008]
jmp 0x4057e8
push edi
call fcn.00405ff6
test eax, eax
je 0x4057e8
push edi
call fcn.004057ee
push edi
call fcn.004059b3
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
jne 0x4057e0
test byte [ebp + 0xc], 4
je 0x4057a0
push edi
push 0xfffffffffffffff1
call fcn.00404fe7
push esi
push edi
call fcn.00405a49
jmp 0x4057e8
push edi
push 0xffffffffffffffe5
call fcn.00404fe7
pop edi
pop esi
leave
ret 8