joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x114724f9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x582a2d0a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c040
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40c0f5
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ReleaseDC]
nop dword [eax]
push 0
push 0
call ebp
add byte [edi + ebx], 0xf4
push 0
push 0
call ebp
add byte [edi + ebx], 0xc6
push 0
push 0
call ebp
add byte [edi + ebx], 0x6d
push 0
push 0
call ebp
xor byte [edi + ebx], 0xb6
push 0
push 0
call ebp
add byte [edi + ebx], 0x99
push 0
push 0
call ebp
add byte [edi + ebx], 0x59
push 0
push 0
call ebp
add byte [edi + ebx], 0x23
push 0
push 0
call ebp
xor byte [edi + ebx], 0xda
push 0
push 0
call ebp
add byte [edi + ebx], 0x5f
push 0
push 0
call ebp
add byte [edi + ebx], 0xbf
push 0
push 0
call ebp
xor byte [edi + ebx], 0x1c
push 0
push 0
call ebp
add byte [edi + ebx], 0xe4
push 0
push 0
call ebp
xor byte [edi + ebx], 0xc8
push 0
push 0
call ebp
add byte [edi + ebx], 0x68
inc ebx
cmp esi, ebx
jne 0x40c060
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40c100
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
mov ebx, eax
jb 0x40c118
mov ebx, dword [eax]
mov esi, dword [esp + 0x40]
xor esi, edi
cmp edi, 4
jae 0x40c127
mov ecx, edi
jmp 0x40c195
mov dword [esp + 0x24], edi
shr edi, 2
xor ebp, ebp
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.GDI32.dll_ArcTo]
sub esp, 0x24
mov dword [esp + 4], str.Z81xbyuAua
mov dword [esp], 0x4d4860
call fcn.00402d5b
mov dword [esp], eax
call fcn.004060eb
imul eax, dword [ebx + ebp*4], 0x5bd1e991
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e991
imul esi, esi, 0x5bd1e991
xor esi, eax
inc ebp
cmp edi, ebp
jne 0x40c130
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
mov edi, dword [esp + 0x24]
and edi, 0xfffffffc
and ecx, 3
xor eax, eax
cmp ecx, 1
je 0x40c1be
cmp ecx, 2
je 0x40c1b4
cmp ecx, 3
jne 0x40c1cc
movsx eax, byte [ebx + edi + 2]
shl eax, 0x10
movsx ecx, byte [ebx + edi + 1]
shl ecx, 8
xor eax, ecx
movsx ecx, byte [ebx + edi]
xor ecx, eax
imul eax, ecx, 0x5bd1e991
xor esi, eax
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e991
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4035bc
Capabilities:
Terminate process

Disassembly:
jmp 0x453cc3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453cd4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058c1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x401450
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 8], 1
je 0x40151e
add eax, 0x41
push eax
lea eax, [ebp - 0x4c]
push 0x405198
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea edi, [esi + 4]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x4014d7
push edi
test esi, esi
jle 0x4014bc
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x4014cb
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov esi, edi
test ebx, ebx
jne 0x4014d7
xor esi, esi
jmp 0x4014de
mov edx, dword [ebp - 0xc]
mov dword [esi + ebx - 4], edx
lea edi, [esi + 4]
test edi, edi
je 0x401517
push edi
test esi, esi
jle 0x4014fc
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x40150b
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov esi, edi
test ebx, ebx
jne 0x401517
xor esi, esi
jmp 0x40151e
mov eax, dword [ebp - 0x10]
mov dword [esi + ebx - 4], eax
mov eax, dword [ebp - 0xc]
shr dword [ebp - 8], 1
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0x20
jl 0x401471
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
call section..text
add esp, 8
cmp dword [ebp - 0x14], 0
jle 0x401561
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401570
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0x288
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x4015b9
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], 0x288
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x4015c1
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
nop
lea edx, [edi + 8]
test edx, edx
je 0x4015f6
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015e0
sub eax, esi
push eax
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
add esp, 8
lea edx, [edi + 0x10c]
test edx, edx
je 0x40161b
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401605
sub eax, esi
push eax
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
add esp, 8
mov ecx, dword [edi + 0x190]
push ecx
lea edx, [edi + 0x194]
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
lea edx, [edi + 0x1b0]
add esp, 8
test edx, edx
je 0x401659
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401643
sub eax, esi
push eax
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
add esp, 8
lea edx, [edi + 0x1c0]
test edx, edx
je 0x40167e
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401668
sub eax, esi
push eax
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
add esp, 8
lea edx, [edi + 0x1d8]
test edx, edx
je 0x4016a6
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401690
sub eax, esi
push eax
push edx
lea esi, [ebp - 0x10]
call fcn.004010c0
add esp, 8
mov edi, dword [edi]
test edi, edi
jne 0x4015d0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push 3
call section..text
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 8
cmp dword [ebp - 0xc], edi
jle 0x4016da
mov ecx, dword [ebp - 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401a30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
nop
test bl, 1
je 0x401a8a
lea eax, [esi + 0x41]
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x72], 0x3a
call edi
cmp eax, 5
je 0x401a8a
lea ecx, [ebp - 0xc]
push ecx
push 0x401950
push 1
lea edx, [ebp - 0x74]
push 0x40519c
push edx
call fcn.00402920
add esp, 0x14
inc esi
shr ebx, 1
cmp esi, 0x20
jl 0x401a50
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0xf
call section..text
add esp, 8
cmp dword [ebp - 8], 0
jle 0x401abc
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401dd0
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x11c]
push edx
mov byte [ebp - 0x11a], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 4
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov ecx, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
test eax, eax
jne 0x401e3d
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x401e42
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
lea esi, [ecx + 4]
test esi, esi
je 0x401e76
push esi
test ecx, ecx
jle 0x401e5c
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401e63
push 0
call edi
push eax
call ebx
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x401e76
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x401e7d
mov edx, dword [ebp - 0x18]
mov dword [ecx + eax - 4], edx
lea esi, [ecx + 4]
test esi, esi
je 0x401eb1
push esi
test ecx, ecx
jle 0x401e97
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401e9e
push 0
call edi
push eax
call ebx
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x401eb1
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x401eb8
mov edx, dword [ebp - 0x10]
mov dword [ecx + eax - 4], edx
lea esi, [ecx + 4]
test esi, esi
je 0x401eea
push esi
test ecx, ecx
jle 0x401ed2
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401ed9
push 0
call edi
push eax
call ebx
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x401eea
mov dword [ebp - 8], eax
jmp 0x401ef1
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax - 4], edx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0x11
call section..text
add esp, 8
cmp dword [ebp - 8], 0
jle 0x401f17
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402670
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40269d
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x40270b
cmp dword [esi + 4], 0
push edi
jle 0x4026c8
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x4026d7
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 4], edi
mov dword [esi], eax
test eax, eax
jne 0x4026f3
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40271b
call fcn.00403f00
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402730
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40275d
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x4027d3
cmp edi, 0xa00000
ja 0x4027d3
cmp dword [esi + 4], 0
push edi
jle 0x402790
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x40279f
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 4], edi
mov dword [esi], eax
test eax, eax
jne 0x4027bb
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4027e3
call fcn.00403f00
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402800
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
push ebx
push edi
mov edi, dword [sym.imp.ntdll.dll__snwprintf]
push eax
push esi
push 0x4051a4
lea ecx, [ebp - 0x650]
push 0x3ff
push ecx
call edi
add esp, 0x14
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402918
jmp 0x402850
mov ecx, 0x4051b0
lea eax, [ebp - 0x224]
jmp 0x402860
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402886
test dx, dx
je 0x402882
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402886
add eax, 4
add ecx, 4
test dx, dx
jne 0x402860
xor eax, eax
jmp 0x40288b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4028fb
mov ecx, 0x4051b8
lea eax, [ebp - 0x224]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4028c6
test dx, dx
je 0x4028c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4028c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4028a0
xor eax, eax
jmp 0x4028cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4028fb
lea ecx, [ebp - 0x224]
push ecx
push esi
push 0x4051a4
lea edx, [ebp - 0x650]
push 0x3ff
push edx
call edi
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x650]
push ecx
call dword [ebp + 8]
add esp, 0x1c
lea edx, [ebp - 0x250]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402850
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402920
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
cmp dword [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x402aac
push 0x104
lea eax, [ebp - 0x864]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push ebx
call fcn.00402800
push esi
push 0x4051bc
lea ecx, [ebp - 0x65c]
push 0x3ff
push ecx
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x18
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x402aac
test byte [ebp - 0x25c], 0x10
je 0x402a89
mov ecx, 0x4051b0
lea eax, [ebp - 0x230]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4029d6
test dx, dx
je 0x4029d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4029d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4029b0
xor eax, eax
jmp 0x4029db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402a89
mov ecx, 0x4051b8
lea eax, [ebp - 0x230]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402a16
test dx, dx
je 0x402a12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402a16
add eax, 4
add ecx, 4
test dx, dx
jne 0x4029f0
xor eax, eax
jmp 0x402a1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402a89
lea ecx, [ebp - 0x230]
push ecx
push esi
push 0x4051a4
lea edx, [ebp - 0x65c]
push 0x3ff
push edx
call dword [sym.imp.ntdll.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x65c]
push ecx
call dword [sym.imp.ntdll.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x402a89
mov eax, dword [ebp + 0x10]
push edi
push ebx
cmp eax, 0xffffffff
jne 0x402a74
mov edx, dword [ebp + 0xc]
push eax
push edx
lea eax, [ebp - 0x65c]
push eax
jmp 0x402a81
mov ecx, dword [ebp + 0xc]
dec eax
push eax
push ecx
lea edx, [ebp - 0x65c]
push edx
call fcn.00402920
add esp, 0x14
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x25c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402996
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f30
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
push edi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push 0x3e8
mov dword [ebx + 8], eax
push eax
lea edi, [ebx + 0x1c]
mov dword [ebx + 0xc], eax
push edi
mov dword [ebx + 0x10], eax
call sub.ntdll.dll_memset
mov ecx, 0x1b
mov esi, str.Mozilla_5.0__Windows_NT_5.2__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_32.0.1700.107_Safari_537.36
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
push str.urlmon.dll
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
test eax, eax
je 0x403fa0
push str.ObtainUserAgentString
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403fa0
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebx + 0x1c]
push ecx
push 0
mov dword [ebp - 4], 0x3e8
call eax
mov eax, ebx
mov esp, ebp
pop ebp
ret