joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554fc0
Capabilities:
Encrypt data using rc6

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, eax
mov ecx, eax
mov edx, eax
and ebx, 0x1000
and eax, 1
shr ecx, 0x10
shl edx, 0x10
or ebx, ecx
or edx, eax
shr ebx, 8
shl edx, 8
push edi
or ebx, edx
mov dword [esi + 8], 0xb7e15163
lea eax, [esi + 0xc]
mov ecx, 0x23
mov edx, dword [eax - 4]
add eax, 4
sub edx, 0x61c88647
dec ecx
mov dword [eax - 4], edx
jne 0x554ffb
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0x6c
push 3
mov ecx, esi
call fcn.00555090
push eax
mov eax, dword [esp + 0x1c]
add eax, ebp
mov ebp, dword [esi + edi*4 + 8]
add eax, ebp
mov ecx, esi
push eax
call fcn.005550c0
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov dword [esi + edi*4 + 8], eax
lea eax, [ecx + ebp]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
call fcn.00555090
mov edx, dword [esp + 0x18]
push eax
add edx, ebx
mov ecx, esi
push edx
call fcn.005550c0
mov ebx, eax
lea eax, [edi + 1]
xor edx, edx
mov ecx, 0x24
div ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
dec eax
mov dword [esp + 0x10], eax
mov edi, edx
jne 0x55501d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x5551c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x60
mov ecx, 8
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
lea edi, [esp + 0x10]
push 0x30
push 0x5c2f5c
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005550e0
mov esi, dword [esp + 0x80]
lea ecx, [esp + 0x1c]
add esp, 0xc
xor eax, eax
sub esi, ecx
mov bl, byte [esp + eax + 0x10]
lea ecx, [esp + eax + 0x10]
mov dl, byte [esi + ecx]
xor dl, bl
mov byte [esp + eax + 0x40], dl
inc eax
cmp eax, 0x30
jl 0x5551f9
mov ebp, dword [esp + 0x7c]
xor ebx, ebx
lea ecx, [esp + 0x45]
lea esi, [ebp + 2]
movsx eax, byte [ecx - 5]
movsx edx, byte [ecx]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 4]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 3]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 2]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 1]
lea eax, [edx + eax*2]
lea edi, [ebx + eax]
mov eax, dword [edi*4 + 0x5c309c]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsx eax, al
and eax, 0x80000001
jns 0x555265
dec eax
or eax, 0xfffffffe
inc eax
mov byte [esi - 2], al
mov eax, dword [edi*4 + 0x5c309c]
cdq
and edx, 3
add eax, edx
sar eax, 2
movsx edx, al
and edx, 0x80000001
jns 0x555288
dec edx
or edx, 0xfffffffe
inc edx
mov byte [esi - 1], dl
mov eax, dword [edi*4 + 0x5c309c]
cdq
sub eax, edx
sar eax, 1
movsx eax, al
and eax, 0x80000001
jns 0x5552a6
dec eax
or eax, 0xfffffffe
inc eax
mov byte [esi], al
movsx edx, byte [edi*4 + 0x5c309c]
and edx, 0x80000001
jns 0x5552bd
dec edx
or edx, 0xfffffffe
inc edx
mov byte [esi + 1], dl
add ebx, 0x40
add ecx, 6
add esi, 4
cmp ebx, 0x200
jl 0x55521d
push 0x20
push 0x5c301c
push ebp
call fcn.005550e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x5552f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50c
mov ecx, dword [esp + 0x514]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x520]
sub ecx, edi
lea ebp, [esp + 0x5c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 8
jmp 0x555320
mov ecx, dword [esp + 0x18]
mov cl, byte [ecx + edi]
mov dl, byte [edi]
mov byte [esp + 0x13], cl
mov esi, ebp
lea ecx, [esp + 0x5c]
xor eax, eax
mov byte [esp + 0x12], dl
mov edx, 7
sub esi, ecx
mov bl, byte [esp + 0x13]
mov cl, dl
sar bl, cl
lea ecx, [esi + eax]
and bl, 1
mov byte [esp + ecx + 0x5c], bl
mov bl, byte [esp + 0x12]
mov cl, dl
sar bl, cl
lea ecx, [esi + eax]
and bl, 1
inc eax
dec edx
cmp eax, 8
mov byte [esp + ecx + 0x1c], bl
jl 0x55533c
mov eax, dword [esp + 0x14]
inc edi
add ebp, 8
dec eax
mov dword [esp + 0x14], eax
jne 0x55531c
push 0x40
lea edx, [esp + 0x20]
push 0x5c2b7c
push edx
call fcn.005550e0
push 0x38
lea eax, [esp + 0x6c]
push str.91__
push eax
call fcn.005550e0
add esp, 0x18
lea ebp, [esp + 0x11c]
mov ebx, 0x5c2e5c
mov ecx, dword [ebx]
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.00555160
mov edi, ebp
add ebx, 4
add esp, 8
mov ecx, 0x10
lea esi, [esp + 0x5c]
add ebp, 0x40
cmp ebx, 0x5c2e9c
rep movsd dword es:[edi], dword [esi]
jl 0x5553a7
push 0x30
lea eax, [esp + 0x4e0]
push 0x5c2e9c
push eax
call fcn.005550e0
mov ecx, 8
lea esi, [esp + 0x28]
lea edi, [esp + 0xe8]
lea edx, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x48]
lea edi, [esp + 0x28]
lea eax, [esp + 0x4e8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa8]
push ecx
push edx
push eax
call fcn.005551c0
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x9c]
mov bl, byte [esp + eax + 0xdc]
xor cl, bl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x20
jl 0x555426
lea ebx, [esp + 0x49c]
mov ebp, 0xf
mov ecx, 8
lea esi, [esp + 0x3c]
lea edi, [esp + 0xdc]
push 0x30
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x20]
lea edi, [esp + 0x40]
push 0x5c2e9c
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.005550e0
lea edx, [esp + 0xa8]
lea eax, [esp + 0x28]
push edx
push eax
push ebx
call fcn.005551c0
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x9c]
mov dl, byte [esp + eax + 0xdc]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x20
jl 0x555492
sub ebx, 0x40
dec ebp
jne 0x55544c
push 0x40
lea edx, [esp + 0x20]
push 0x5c2c7c
push edx
call fcn.005550e0
mov eax, dword [esp + 0x534]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00555120
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50c
ret
Function at 0x401024
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
push edi
xor eax, eax
push 0x18e
mov word [ebp - 0x198], ax
xor edi, edi
lea eax, [ebp - 0x196]
push edi
push eax
call fcn.00424920
add esp, 0xc
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x44035c]
push dword [0x440354]
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, 0x440350
call fcn.004064fd
push 0x5c
call fcn.004064d3
cmp eax, edi
jle 0x40109b
mov ecx, dword [0x440354]
cmp ecx, edi
je 0x40109b
cmp eax, dword [0x440358]
jae 0x40109b
xor edx, edx
mov dword [0x440358], eax
mov word [ecx + eax*2], dx
call fcn.0040b0c9
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4010cd
push 0x10
push str.Network_error
push str.WSA_sockets_startup_failed_
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x401100
call fcn.0040ec1d
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00406459
call fcn.004062b4
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x406fd1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x406fdf
push 0xd
pop eax
jmp 0x407012
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406fe6
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x407461
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 4]
push dword [esi]
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00407423
mov ebx, eax
cmp ebx, edi
je 0x4074a4
cmp dword [ebp - 0xc], edi
je 0x4074a0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x407511
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4074c2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc]
call fcn.00407461
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x407518
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x100
call ebx
test eax, eax
je 0x4074ac
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x4074f8
push dword [ebp - 0xc]
call ebx
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
call fcn.00407577
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x40750f
push dword [ebp - 0xc]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 0xc], edi
je 0x407526
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x407511

Function at 0x407577
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x4402cc], 0
jne 0x4075a7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x4075a0
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4402d0], eax
mov byte [0x4402cc], 1
mov eax, dword [0x4402d0]
test eax, eax
je 0x4075bf
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x4075cb
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x407d92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
xor esi, esi
push 2
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x40c], esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x407dca
call fcn.00406b4c
mov esi, eax
jmp 0x407eb5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x407de7
call fcn.00406b4c
jmp 0x407eac
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp + 8], eax
cmp eax, esi
je 0x407ddd
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x407e2a
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407e20
lea eax, [ebp - 0x40c]
call fcn.00407016
mov eax, 0x8007000e
jmp 0x407ed0
push 2
pop ecx
mul ecx
cmp edx, esi
ja 0x407e38
cmp eax, 0xffffffff
jbe 0x407e42
push 0x80070057
call fcn.00407355
cmp eax, 0x400
jbe 0x407e58
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.0040701f
jmp 0x407e64
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], esi
jne 0x407e73
mov esi, 0x8007000e
jmp 0x407eae
push edi
push dword [ebp - 0x40c]
push edi
push dword [ebp + 8]
push esi
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, esi
je 0x407ddd
mov edx, dword [ebp - 0x40c]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x40c]
lea ecx, [ebp - 8]
call fcn.00407c62
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407ece
lea eax, [ebp - 0x40c]
call fcn.00407016
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x408755
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4087b9
cmp dword [ebp + 0xc], 1
je 0x408791
cmp dword [ebp + 0xc], 2
je 0x408791
push 0xd
pop eax
jmp 0x4087b9
mov eax, dword [ebp - 4]
test edi, edi
je 0x4087b3
test eax, eax
je 0x4087ae
test al, 1
jne 0x40878c
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4087b3
jmp 0x40878c
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x408f65
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x408faf
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x408fd6
shr eax, 2
test al, 1
je 0x408fdf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x409012
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x43696c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x409011
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret

Function at 0x40b139
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b8
push ebx
push esi
lea eax, [ebp - 0x9b8]
call fcn.0040653c
lea eax, [ebp - 0x218]
call fcn.0040653c
lea eax, [ebp - 0x7a0]
call fcn.00409fbe
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x464]
push ebx
push eax
mov dword [ebp - 0x468], ebx
call fcn.00424920
add esp, 0xc
push str.English
lea esi, [ebp - 0x218]
call fcn.0040afec
mov eax, esi
lea ecx, [ebp - 0x7a0]
call fcn.0040a141
test al, al
jne 0x40b1b4
lea eax, [ebp - 0x7a0]
call fcn.0040a003
pop esi
mov al, bl
pop ebx
leave
ret
lea eax, [ebp - 0x7a0]
push eax
call fcn.0040b713
push 0x4333f8
push dword [0x440354]
lea eax, [ebp - 0x9b8]
push str._slanguages_s_.lng
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x9b4]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b252
lea eax, [ebp - 0x43c]
push eax
push dword [0x440354]
lea eax, [ebp - 0x218]
push str._slanguages_s
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x7a0]
call fcn.0040a141
test al, al
je 0x40b239
lea eax, [ebp - 0x7a0]
push eax
call fcn.0040b713
lea eax, [ebp - 0x468]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40b1f8
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
jmp 0x40b1a3
Function at 0x40b259
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbd0
push ebx
push esi
lea eax, [ebp - 0x430]
call fcn.0040653c
lea eax, [ebp - 0x898]
call fcn.0040653c
lea eax, [ebp - 0x218]
call fcn.0040653c
lea eax, [ebp - 0xbd0]
call fcn.00409fbe
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x67c]
push ebx
push eax
mov dword [ebp - 0x680], ebx
call fcn.00424920
add esp, 0xc
push dword [ebp - 0x214]
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x40b2d4
lea eax, [ebp - 0xbd0]
call fcn.0040a003
pop esi
mov al, bl
pop ebx
leave
ret
lea esi, [ebp - 0x218]
call fcn.004064fd
mov esi, 0x4333f8
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push str._s_s_
call fcn.004017c3
add esp, 0xc
push dword [ebp - 0x42c]
push 0x40b3bc
push 0xa
push ebx
call dword [sym.imp.KERNEL32.DLL_EnumResourceNamesW]
push 0x436ad0
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push str._s_s_._s
call fcn.004017c3
add esp, 0x10
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b3b5
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x898]
push str._s_s
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x898]
lea ecx, [ebp - 0xbd0]
call fcn.0040a141
test al, al
je 0x40b38c
lea eax, [ebp - 0xbd0]
push eax
call fcn.0040b713
push dword [ebp - 0x894]
push 0x440590
call fcn.0040bb49
lea eax, [ebp - 0x680]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40b34b
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
jmp 0x40b2c3

Function at 0x40b619
Capabilities:
Delete file

Disassembly:
push esi
xor esi, esi
cmp dword [0x440598], esi
jbe 0x40b642
mov eax, dword [0x4405a0]
imul eax, esi
add eax, dword [0x440594]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
inc esi
cmp esi, dword [0x440598]
jb 0x40b624
and dword [0x440598], 0
pop esi
ret
Function at 0x40bca5
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40bd0d
cmp dword [ebp + 0xc], esi
je 0x40bd0d
cmp dword [ebp + 0x10], esi
je 0x40bd0d
cmp dword [ebp + 0x14], esi
je 0x40bd0d
mov eax, dword [edi]
cmp eax, esi
je 0x40bd0d
cmp dword [eax + 0xc], esi
je 0x40bd0d
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40bd0d
lea eax, [ebp - 8]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x40bd14
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40bd37
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x40bd03
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40bd5f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x40bd03
push esi
push esi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x40bd4e
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x40bd0f
Function at 0x40c4fc
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
push ebx
push esi
push edi
xor eax, eax
push 0x40e
mov word [ebp - 0x874], ax
xor esi, esi
lea eax, [ebp - 0x872]
push esi
push eax
call fcn.00424920
add esp, 0xc
cmp dword [ebp + 0xc], esi
je 0x40c690
cmp dword [ebp + 0x10], esi
je 0x40c690
cmp dword [ebp + 0x14], esi
je 0x40c690
cmp dword [ebp + 0x18], esi
je 0x40c690
lea eax, [ebp - 0x874]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40c690
lea ebx, [ebp - 0x874]
call fcn.0040cd4c
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c690
push 0x24c
lea eax, [ebp - 0x258]
push esi
push eax
mov dword [ebp - 0x25c], esi
call fcn.00424920
mov eax, ebx
push eax
mov ebx, 0x103
push 0x436d58
mov ecx, ebx
lea edi, [ebp - 0x464]
call fcn.0040ccff
add esp, 0x14
lea eax, [ebp - 0x25c]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40c690
test byte [ebp - 0x25c], 2
jne 0x40c5f0
test byte [ebp - 0x25c], 0x10
je 0x40c5f0
cmp word [ebp - 0x230], 0x2e
jne 0x40c606
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40c5d4
jmp 0x40c683
push dword [ebp + 0x10]
lea eax, [ebp - 0x230]
push dword [ebp + 0xc]
mov esi, str._s_s_s_s.sol
push eax
lea eax, [ebp - 0x874]
push eax
push esi
mov ecx, ebx
lea edi, [ebp - 0x464]
call fcn.0040ccff
mov eax, edi
push 0x5c
push eax
call fcn.00422a4d
add esp, 0x1c
test eax, eax
je 0x40c643
xor ecx, ecx
mov word [eax], cx
lea ebx, [ebp - 0x464]
call fcn.0040cc5f
push dword [ebp + 0x10]
lea eax, [ebp - 0x230]
push dword [ebp + 0xc]
mov ecx, 0x103
push eax
lea eax, [ebp - 0x874]
push eax
push esi
mov edi, ebx
call fcn.0040ccff
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push eax
call fcn.0040c699
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
jmp 0x40c692
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40c699
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, 0xbf00
mov word [ebp - 0x18], ax
xor eax, eax
push esi
push edi
mov dword [ebp - 0x16], eax
mov byte [ebp - 0x12], 0x54
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x4f
mov byte [ebp - 0xe], al
mov byte [ebp - 0xd], 4
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], al
mov byte [ebp - 9], al
cmp dword [ebp + 8], eax
je 0x40c89e
cmp dword [ebp + 0xc], eax
je 0x40c89e
cmp dword [ebp + 0x10], eax
je 0x40c89e
push 2
push 3
push 0x40000000
push dword [ebp + 8]
mov eax, ebx
call fcn.00401897
test al, al
je 0x40c89e
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c70e
sub eax, edx
mov esi, eax
mov eax, str.uniq
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c721
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c732
add esi, ecx
sub eax, edi
lea eax, [esi + eax + 0x14]
movzx eax, ax
mov edx, eax
mov esi, eax
mov ecx, 0xff00
and edx, ecx
shl esi, 0x10
add edx, esi
mov esi, eax
shl edx, 8
sar esi, 8
and esi, ecx
sar eax, 0x18
add edx, esi
add edx, eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, ebx
mov dword [ebp - 0x16], edx
call fcn.0040ab0b
cmp eax, 0x10
jne 0x40c88e
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c784
and dword [ebp - 8], 0
sub eax, ecx
movzx edi, ax
mov eax, edi
shl eax, 8
movzx eax, ax
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040ab0b
cmp eax, 2
jne 0x40c88e
movzx esi, di
push esi
push dword [ebp + 0xc]
mov eax, ebx
call fcn.0040ab0b
cmp eax, esi
jne 0x40c88e
push 3
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.0040ab0b
cmp eax, 3
jne 0x40c88e
mov eax, str.uniq
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c7e9
sub eax, edx
movzx edi, ax
mov eax, edi
shl eax, 9
add eax, 0x103
movzx eax, ax
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040ab0b
cmp eax, 2
jne 0x40c88e
movzx esi, di
push esi
push str.uniq
mov eax, ebx
call fcn.0040ab0b
cmp eax, esi
jne 0x40c88e
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c831
sub eax, edx
movzx edi, ax
mov eax, edi
shl eax, 9
add eax, 0x106
movzx eax, ax
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040ab0b
cmp eax, 2
jne 0x40c88e
movzx esi, di
push esi
push dword [ebp + 0x10]
mov eax, ebx
call fcn.0040ab0b
cmp eax, esi
jne 0x40c88e
push 1
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.0040ab0b
cmp eax, 1
jne 0x40c88e
mov esi, ebx
call fcn.004019af
mov al, 1
jmp 0x40c8a0
mov esi, ebx
call fcn.004019af
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor al, al
pop edi
pop esi
leave
ret 0xc