joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2f34
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a30de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e60
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x4a30b3
mov eax, edi
call fcn.00402b18
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a30ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4a30f0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x14], 0
ja 0x4a2fdb
mov ecx, 0x4a3114
mov dl, 1
mov eax, dword [0x408070]
call fcn.0040e4bc
call fcn.00404314
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xffff
mov edx, 4
call fcn.004093f8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xffff
mov edx, 4
call fcn.004093f8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea eax, [ebp - 0x28]
push eax
xor eax, eax
mov al, bl
mov ecx, dword [eax*4 + 0x4a7740]
lea eax, [ebp - 0x34]
mov edx, 0x4a3138
call fcn.00404cac
mov eax, dword [ebp - 0x34]
mov ecx, 1
pop edx
call fcn.0040a420
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404e60
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x14], 0
jbe 0x4a3096
mov eax, dword [ebp + 8]
call fcn.00404984
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
call fcn.00404fec
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00404e60
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00409d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a30b3
mov eax, dword [ebp - 0xc]
call fcn.00402b48
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a30e5
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004049a8
lea eax, [ebp - 0x18]
call fcn.00404984
lea eax, [ebp - 4]
call fcn.00404984
ret
Function at 0x401000
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push edi
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], 0x22
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0x40c]
push eax
xor edi, edi
call ebx
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x401117
lea edx, [esi + 2]
push 2
pop ecx
cmp ax, 0x2f
jne 0x401107
add esi, ecx
movzx eax, word [esi]
add edx, ecx
cmp eax, 0x64
jg 0x40108c
je 0x40107e
sub eax, 0x44
je 0x40107e
dec eax
je 0x4010a6
sub eax, 3
je 0x40109a
sub eax, 6
je 0x401091
dec eax
jne 0x401107
mov dword [0x41e338], 1
jmp 0x401088
mov dword [0x41e340], 1
mov edi, edx
jmp 0x401107
sub eax, 0x65
jmp 0x40105f
and dword [0x41e33c], 0
jmp 0x401088
mov dword [0x41e344], 1
jmp 0x401088
add esi, ecx
add edx, ecx
cmp word [esi], 0x3a
jne 0x401107
add esi, ecx
add edx, ecx
cmp word [esi], 0x22
mov dword [ebp - 4], edx
push 0x20
jne 0x4010cc
pop eax
mov word [esi], ax
add esi, ecx
add edx, ecx
mov dword [ebp - 4], edx
push 0x22
push esi
call fcn.004099a5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4010df
xor eax, eax
mov word [edi], ax
push esi
push 0x41e238
call ebx
test edi, edi
je 0x4010f3
push 0x20
pop eax
mov word [edi], ax
jmp 0x4010fe
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [esi + eax*2 - 2]
mov edx, dword [ebp - 4]
push 2
add edi, 2
pop ecx
add esi, ecx
movzx eax, word [esi]
add edx, ecx
test ax, ax
jne 0x40103e
cmp word [0x41e238], 0
jne 0x401128
and dword [0x41e340], 0
lea eax, [ebp - 0x40c]
push 0x22
push eax
call fcn.004099a5
xor esi, esi
pop ecx
pop ecx
cmp eax, esi
jne 0x401157
cmp edi, esi
jne 0x4011e9
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0xc]
call ebx
jmp 0x4011bb
add eax, 2
cmp word [eax], 0x20
je 0x401154
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.004099cc
pop ecx
pop ecx
cmp eax, esi
je 0x4011bb
cmp word [eax], si
je 0x4011bb
push eax
push dword [ebp + 0xc]
call ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.004099cc
pop ecx
pop ecx
cmp eax, esi
je 0x4011bb
cmp word [eax], 0x20
jne 0x4011bb
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.004099cc
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4011b9
cmp word [esi], 0
je 0x4011b9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4011b9
push esi
push 0x41e030
call ebx
xor esi, esi
mov edi, dword [ebp + 0xc]
cmp word [edi], si
je 0x401231
push edi
call fcn.00402355
pop ecx
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x4011e5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x401231
xor eax, eax
jmp 0x401234
movzx eax, word [edi]
cmp ax, si
jne 0x40121d
lea eax, [ebp - 0x40c]
push 0x2f
push eax
call fcn.004099a5
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0xc]
call fcn.00402355
pop ecx
jmp 0x4011bb
cmp eax, 0x20
jne 0x40122b
add edi, 2
cmp word [edi], 0x20
je 0x401222
push edi
jmp 0x40114d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f39
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x4016d2
push 0
push 0x7d8
push dword [0x41e420]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x41e438], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41e438]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebp
ret

Function at 0x402118
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0xc], eax
jbe 0x40214c
push esi
mov ecx, dword [ebp + 8]
movzx edx, byte [eax + ecx]
mov ecx, dword [0x41e558]
movzx esi, cl
xor edx, esi
shr ecx, 8
xor ecx, dword [edx*4 + 0x41e560]
inc eax
mov dword [0x41e558], ecx
cmp eax, dword [ebp + 0xc]
jb 0x402123
pop esi
pop ebp
ret

Function at 0x4021b7
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00409e12
mov esi, eax
movzx eax, word [esi + 2]
pop ecx
push 0x5c
pop ebx
cmp eax, 0x3a
jne 0x4021eb
cmp word [esi + 4], bx
jne 0x4021eb
push ebx
push esi
call fcn.004099a5
pop ecx
pop ecx
jmp 0x402224
cmp word [esi], bx
jne 0x4022cf
cmp ax, bx
jne 0x4022cf
push esi
call fcn.00409e67
pop ecx
cmp eax, 7
jbe 0x4022cf
lea eax, [esi + 4]
push ebx
push eax
call fcn.004099a5
add eax, 2
push ebx
push eax
call fcn.004099a5
add esp, 0x10
mov edi, eax
push esi
test edi, edi
je 0x4022d0
call fcn.00409e67
cmp word [esi + eax*2 - 2], bx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
pop ecx
je 0x40224a
push 0x416408
push edi
call ebx
and dword [ebp - 0x208], 0
push 0x204
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00409cd0
add esp, 0xc
xor eax, eax
mov word [edi], ax
push esi
lea eax, [ebp - 0x208]
push eax
call ebx
push 0x416408
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4022a9
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4022cf
add edi, 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
push esi
call fcn.004099a5
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x402267
push esi
call fcn.00409dd8
xor eax, eax
inc eax
jmp 0x4022d7
push esi
call fcn.00409dd8
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402963
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
push ebx
push esi
push edi
call fcn.004020e7
xor esi, esi
push esi
push esi
push esi
push 0x67
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, eax
push 5
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0040a2c8
add esp, 0xc
push 0x3ec
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0x18]
mov ecx, 0x19000
cdq
idiv ecx
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
push 0x406
push dword [ebp - 8]
call edi
mov dword [ebp + 0x14], esi
jmp 0x402a4d
cmp ebx, esi
je 0x402a71
lea eax, [ebp - 0xe24]
push ebx
push eax
call fcn.00402118
add dword [ebp + 0x14], ebx
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x14]
xor edx, edx
mov ecx, 0x19000
div ecx
push esi
push eax
push 0x402
push dword [ebp - 8]
call edi
push 1
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402a4d
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x402a4d
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [ebp + 8]
lea eax, [ebp - 0xe24]
push 0x800
push 1
push eax
call fcn.0040a221
mov ebx, eax
add esp, 0x10
cmp ebx, 0xffffffff
jne 0x4029dc
cmp dword [ebp - 4], esi
je 0x402a7f
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x41e558]
not eax
mov dword [0x41e558], eax
cmp dword [ebp + 0x10], esi
je 0x402ae0
cmp dword [ebp + 0x10], eax
je 0x402ae0
push 0x100
lea eax, [ebp - 0x224]
push eax
push 0x12
push dword [0x41e420]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 0x1c]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0x4164cc
lea eax, [ebp - 0x624]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031ca
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x41fe38], esi
jne 0x4032b1
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov edi, dword [ecx]
push esi
push dword [0x41e420]
push 0x3e8
push eax
mov eax, dword [ecx + 0xc]
sub eax, edx
push eax
mov eax, dword [ecx + 8]
sub eax, edi
push eax
push edx
push edi
push 0x56b40440
push esi
push str.LISTBOX
push 0x40080
call dword [sym.imp.USER32.dll_CreateWindowExW]
push esi
push dword [ebp + 0xc]
mov dword [0x41fe38], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x41fe48], esi
jne 0x403249
push 0xfffffffffffffffc
push dword [0x41fe38]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [0x41fe48], eax
push 0x402eda
push 0xfffffffffffffffc
push dword [0x41fe38]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [0x41fe40], esi
jne 0x4032b0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x402fe7
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov ebx, 0xcb
push ebx
push dword [0x41fe3c]
mov dword [0x41fe40], eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x4032af
push esi
push ebx
push dword [0x41fe3c]
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x403459
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor esi, esi
push 0x20
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x800
call fcn.00409cd0
add esp, 0xc
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
and dword [ebp - 0x18], 0
push 2
mov ebx, eax
mov eax, dword [str.Microsoft_Windows_Network]
pop edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x28], esi
push 0
inc esi
push esi
push edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403579
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x800
mov dword [ebp - 0xc], esi
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x40356b
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
and dword [ebp - 4], 0
push dword [ebx + 0x14]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push esi
push edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x40356b
mov edi, 0x800
jmp 0x403550
cmp dword [ebp + 8], 0
je 0x403547
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 8]
push dword [ebx + 0x14]
call fcn.0040a549
add esp, 0xc
test eax, eax
jne 0x403550
push dword [ebx + 0x14]
call fcn.00402024
pop ecx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x403525
cmp dword [ebp - 4], 0
je 0x403579
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403585
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
push 0x20
lea eax, [ebp - 0x30]
push esi
mov ebx, 0x800
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call fcn.00409cd0
add esp, 0xc
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push 2
pop edi
mov dword [ebp - 0x1c], eax
mov eax, dword [str.Microsoft_Windows_Network]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], esi
push 0
inc esi
push esi
push edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403630
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push esi
push edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403628
mov edi, dword [ebp - 0x10]
jmp 0x40360d
push dword [edi + 0x14]
call fcn.00402024
pop ecx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], esi
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x403604
push dword [ebp - 8]
call sub.MPR.dll_WNetCloseEnum
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4038f1
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x420300]
mov ecx, eax
xor ecx, dword [ebp + 8]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x41feb0]
mov ecx, dword [0x420308]
mov dword [0x420300], eax
movzx eax, al
add eax, dword [0x420304]
push esi
imul eax, eax, 0x8088405
inc eax
mov esi, ecx
mov dword [0x420304], eax
shr eax, 0x18
and esi, edx
xor eax, esi
shr ecx, 8
xor ecx, dword [eax*4 + 0x41feb0]
mov eax, dword [ebp + 8]
mov dword [0x420308], ecx
pop esi
pop ebp
ret

Function at 0x4039ce
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x458]
push str._s.
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403a94
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x250], 0x10
je 0x403a7a
push 0x416560
lea eax, [ebp - 0x224]
push eax
call edi
test eax, eax
je 0x403a7a
push 0x416558
lea eax, [ebp - 0x224]
push eax
call edi
test eax, eax
je 0x403a7a
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push str._s_s_
push eax
call esi
lea eax, [ebp - 0x458]
push eax
call fcn.004039ce
add esp, 0x14
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403a19
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403af5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41e43c], 0
je 0x403b06
or eax, 0xffffffff
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [0x41feac]
push esi
call fcn.00403acb
push dword [0x42030c]
mov dword [0x41feac], eax
push esi
push 1
push dword [ebp + 8]
call fcn.0040ac88
add esp, 0x14
cmp eax, esi
jne 0x403b01
push dword [0x41fe64]
call fcn.0040aac4
pop ecx
cdq
mov ecx, 0x2800
idiv ecx
push eax
push 0
push 0x3ec
push dword [0x41e438]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop ebp
ret
Function at 0x403b5d
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
xor ebx, ebx
push edi
mov edi, eax
mov dword [0x41fe68], ebx
mov dword [0x41fe6c], ebx
cmp edi, ebx
jne 0x403b8a
mov dword [0x41fe60], ebx
xor eax, eax
inc eax
jmp 0x403d2d
cmp byte [edi], bl
jne 0x403b95
xor eax, eax
jmp 0x403d2d
push dword [0x41fe64]
mov dword [0x41fe60], 1
call fcn.0040aac4
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
pop ecx
mov dword [ebp - 8], edx
cmp eax, ebx
je 0x403c14
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov ebx, ecx
or ebx, edx
jne 0x403bc9
and dword [esi + 0x2c], ebx
jmp 0x403b82
push 0
push eax
push edx
push ecx
push edi
push dword [0x41fe64]
call fcn.004072c3
mov ecx, eax
and ecx, edx
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x403bfe
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [0x41fe64]
call fcn.0040b10d
add esp, 0x10
jmp 0x403b8e
mov dword [0x41fe68], eax
mov dword [0x41fe6c], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403b82
mov dword [0x420300], 0x12345678
mov dword [0x420304], 0x23456789
mov dword [0x420308], 0x34567890
jmp 0x403c3f
movsx eax, al
push eax
call fcn.004038f1
pop ecx
inc edi
mov al, byte [edi]
test al, al
jne 0x403c34
mov ebx, 0x400
push ebx
mov edi, 0x41feb0
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.0040ad10
push dword [0x41fe64]
and dword [ebp - 4], 0
push 0xc
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.0040a221
add esp, 0x1c
cmp eax, 0xc
jne 0x403d07
and dword [ebp - 4], 0
mov edx, dword [ebp - 4]
lea edx, [ebp + edx - 0x18]
call fcn.004038d1
movzx ecx, byte [edx]
xor eax, ecx
mov byte [edx], al
movzx eax, al
push eax
call fcn.004038f1
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc
pop ecx
jne 0x403c84
test byte [0x41fe74], 8
movzx eax, byte [0x41fe79]
jne 0x403cc1
movzx eax, byte [0x41fe7f]
movzx ecx, byte [ebp - 0xd]
cmp ecx, eax
je 0x403d00
cmp dword [esi + 0xc], 0
je 0x403d00
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x403d00
push ebx
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0040ad10
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [0x41fe64]
call fcn.0040b10d
add esp, 0x1c
jmp 0x403b8e
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x403d20
jg 0x403d18
cmp eax, 0xc
jbe 0x403d20
sub eax, 0xc
sbb ecx, 0
jmp 0x403d24
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], ecx
pop edi
pop ebx
leave
ret

Function at 0x403d39
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [0x41fe64]
push dword [ebp + 8]
push 1
push edi
call fcn.0040a221
xor esi, esi
add esp, 0x10
mov ebx, eax
cmp dword [0x41fe60], esi
je 0x403d97
mov eax, dword [0x41fe68]
or eax, dword [0x41fe6c]
je 0x403d76
push ebx
push edi
call fcn.00407380
pop ecx
pop ecx
jmp 0x403d97
cmp ebx, esi
jle 0x403d97
call fcn.004038d1
movzx ecx, byte [esi + edi]
xor eax, ecx
mov byte [esi + edi], al
movzx eax, al
push eax
call fcn.004038f1
inc esi
pop ecx
cmp esi, ebx
jl 0x403d7a
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x405491
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push ebx
push dword [0x41fe64]
call fcn.0040b10d
push dword [0x41fe64]
call fcn.0040aac4
mov esi, edx
add esp, 0x14
mov edi, eax
cmp esi, ebx
jg 0x4054e6
jl 0x4054ce
cmp edi, 0x100
ja 0x4054e6
push ebx
push ebx
push 0x14
push dword [0x41fe64]
call fcn.0040b10d
add esp, 0x10
xor edi, edi
xor esi, esi
jmp 0x40550a
add edi, 0xffffff00
push ebx
adc esi, 0xffffffff
push esi
push edi
push dword [0x41fe64]
call fcn.0040b10d
add esp, 0x10
cmp esi, ebx
jl 0x405591
jle 0x405589
push dword [0x41fe64]
lea eax, [ebp - 0x100]
push 0x100
push 1
push eax
call fcn.0040a221
add esp, 0x10
cmp eax, ebx
jbe 0x405591
add eax, 0xfffffffb
xor ecx, ecx
cmp eax, ebx
jbe 0x405569
cmp byte [ebp + ecx - 0xff], 0x50
jne 0x405564
cmp byte [ebp + ecx - 0xfe], 0x4b
jne 0x405564
cmp byte [ebp + ecx - 0xfd], 5
jne 0x405564
cmp byte [ebp + ecx - 0xfc], 6
jne 0x405564
cmp byte [ebp + ecx - 0xfb], bl
je 0x40559a
inc ecx
cmp ecx, eax
jb 0x405533
add edi, 0xffffff00
push ebx
adc esi, 0xffffffff
push esi
push edi
push dword [0x41fe64]
call fcn.0040b10d
add esp, 0x10
cmp esi, ebx
jg 0x40550a
jl 0x405591
cmp edi, ebx
jae 0x40550a
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push ebx
push dword [0x41fe64]
lea esi, [ebp + ecx - 0xfb]
call fcn.0040b10d
movzx eax, byte [esi + 0xf]
movzx ecx, byte [esi + 0xe]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xd]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xc]
shl eax, 8
add esp, 0x10
or eax, ecx
cdq
mov dword [0x420310], eax
mov dword [0x420314], edx
jmp 0x405595
Function at 0x405c29
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
push edi
push dword [0x41fe64]
call fcn.0040aac4
mov esi, dword [ebp + 0xc]
mov ebx, 0x400
push ebx
xor edi, edi
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call fcn.00409cd0
push dword [0x41fe64]
push ebx
push 1
push esi
call fcn.0040a221
add esp, 0x20
jmp 0x405d52
cmp eax, 0x14
jbe 0x405d5a
add eax, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
cmp eax, edi
jbe 0x405d16
cmp byte [ecx + esi], 0x50
jne 0x405d02
cmp byte [ecx + esi + 1], 0x4b
jne 0x405d02
cmp byte [ecx + esi + 2], 3
jne 0x405d02
cmp byte [ecx + esi + 3], 4
jne 0x405d02
push dword [0x41fe64]
call fcn.0040aac4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 4
push edi
adc ecx, edi
push ecx
push eax
push dword [0x41fe64]
mov dword [ebp - 0x10], edx
call fcn.0040b10d
mov edi, dword [ebp + 8]
add esp, 0x14
lea esi, [ebp - 0x818]
call fcn.0040598f
test eax, eax
jne 0x405d63
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [0x41fe64]
call fcn.0040b10d
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
add esp, 0x10
xor edi, edi
add dword [ebp - 8], 1
adc dword [ebp - 4], edi
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x405c8b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffec
push dword [0x41fe64]
call fcn.0040b10d
push dword [0x41fe64]
call fcn.0040aac4
push ebx
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call fcn.00409cd0
push dword [0x41fe64]
push ebx
push 1
push esi
call fcn.0040a221
add esp, 0x30
cmp eax, edi
jne 0x405c6f
xor eax, eax
pop edi
pop esi
xor edx, edx
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x405d5c