joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dfce0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x420]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100dfd2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.100bcf30
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.100df8f0
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x100dfe70
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x14c]
jne 0x100dffbe
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x100dfebe
lea eax, [ebp + 1]
mov byte [ebp], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x100dfebe
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dfebe
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x1c]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100dff29
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
mov dword [edi], ebp
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.100df9f0
mov edi, dword [esp + 0x28]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x420]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x100dff7d
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100bcf30
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.100dfd50
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x420]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100dffbb
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100bcf30
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100f2be0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100f2c07
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x100f2c52
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x100f2c56
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100f2cb6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100f2c75
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x100f2ce7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x10112fd6
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10112fd7
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x100f2cc0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100fd945
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
movzx eax, ax
mov edx, ecx
push edi
mov edi, eax
mov dword [ebp - 8], eax
shr edi, 8
mov ebx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x100fd9a4
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + ebx*2]
mov esi, eax
movzx eax, al
shr esi, 8
add esi, edx
cmp edi, eax
jb 0x100fd9a4
jne 0x100fd99c
cmp edx, esi
jge 0x100fd99c
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [edx + eax]
cmp ax, word [ebp - 4]
je 0x100fd9c8
inc edx
cmp edx, esi
jl 0x100fd98a
inc ebx
mov edx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x100fd966
mov bl, 1
cmp dword [ebp + 0x1c], ecx
jbe 0x100fd9db
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
test al, al
jns 0x100fd9cc
inc ecx
and eax, 0x7f
shl eax, 8
movzx edx, byte [ecx + esi]
or edx, eax
jmp 0x100fd9ce
xor al, al
jmp 0x100fd9dd
mov edx, eax
sub edi, edx
js 0x100fd9db
xor bl, 1
inc ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x100fd9b1
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401076
Capabilities:
Create http request
Create thread

Disassembly:
push ebx
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.VIP_TRACKING
mov dword [esi + 8], edi
call dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push edi
push edi
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
lea eax, [esi + 4]
push eax
push edi
push ebx
push 0x401117
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
mov eax, esi
pop ebx
ret
Function at 0x4015b8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x401609
test edi, edi
je 0x40160d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015cb
sub eax, edx
je 0x401609
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015db
sub eax, edx
je 0x401609
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Attempting_to_send
call esi
push dword [ebp + 8]
call esi
push str._to_URL:
call esi
push edi
call esi
push 0x453338
call esi
test edi, edi
jne 0x40164a
mov eax, dword [0x469e44]
test eax, eax
je 0x40167b
push 0
push 0
push 0x12
push dword [eax + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call fcn.0043ac0b
and dword [0x469e44], 0
pop ecx
jmp 0x40167b
cmp dword [0x469e44], 0
jne 0x40166f
push 0x10
call fcn.0043ac16
pop ecx
test eax, eax
je 0x401668
mov esi, eax
call fcn.00401076
jmp 0x40166a
xor eax, eax
mov dword [0x469e44], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.004010be
pop esi
leave
ret

Function at 0x401b74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x114]
cmp eax, 0xffffffff
je 0x401bad
xor esi, esi
push esi
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ba9
cmp dword [ebp - 4], esi
je 0x401ba9
xor eax, eax
inc eax
jmp 0x401bd2
xor eax, eax
jmp 0x401bd2
mov eax, dword [esi + 4]
cmp eax, dword [esi + 0x118]
jb 0x401bbc
xor al, al
jmp 0x401bd2
mov ecx, dword [esi]
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call fcn.0043b850
add esp, 0xc
add dword [esi + 4], edi
mov al, 1
pop esi
leave
ret 4

Function at 0x4026c2
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4030a3
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
mov edx, 0xf8c9
xor eax, eax
jmp 0x4030c1
imul eax, edx
imul edx, edx, 0x5c6b7
movsx ecx, cl
add eax, ecx
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x4030b2
cmp dword [ebp + 8], 0
pop esi
je 0x4030d5
xor edx, edx
div dword [ebp + 8]
mov eax, edx
pop ebp
ret
Function at 0x403f6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
push dword [ebp - 4]
mov esi, 0x46a4b0
push 0x45373c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push esi
push esi
push SysReAllocStringLen
mov dword [ebp - 8], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
mov eax, esi
je 0x403fc6
mov eax, 0x46a4c4
pop esi
leave
ret

Function at 0x404ab9
Capabilities:
Accept command line arguments
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
jne 0x404ad2
mov eax, dword [0x4690b8]
mov eax, dword [eax]
mov esi, str._repair
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404aea
mov al, 1
jmp 0x404bac
push 0x3ff
lea eax, [ebp - 0x457]
push ebx
push eax
mov byte [ebp - 0x458], bl
call fcn.0043bbc0
add esp, 0xc
push ebx
mov eax, 0x103
lea edi, [ebp - 0x458]
call fcn.00402362
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x404b17
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x458]
push eax
mov eax, dword [0x4690b8]
movsd dword es:[edi], dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x4540f8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x40
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0043bbc0
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
add esp, 0x1c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
lea eax, [ebp - 0x458]
push eax
push ebx
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x3e8
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x404baa
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404bb1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x157]
push ebx
push eax
mov byte [ebp - 0x158], bl
call fcn.0043bbc0
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push str._s__delete__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0043bbc0
add esp, 0x20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
push ebx
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebx
leave
ret
Function at 0x404c39
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
inc edi
cmp dword [0x4690b4], edi
jle 0x404d09
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov dword [ebp - 4], 2
mov eax, dword [0x4690b8]
push str._delete
mov esi, edi
push dword [eax + esi*4]
call ebx
test eax, eax
je 0x404d10
mov eax, dword [0x4690b8]
push str._noui
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x404c90
mov eax, dword [ebp + 8]
or byte [eax], 2
jmp 0x404cf9
mov eax, dword [0x4690b8]
push str._package
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x404cc7
mov eax, dword [ebp + 8]
or byte [eax], 4
mov eax, dword [ebp - 4]
cmp eax, dword [0x4690b4]
jge 0x404cf9
mov eax, dword [0x4690b8]
mov ecx, dword [ebp + 0xc]
inc edi
mov eax, dword [eax + edi*4]
inc dword [ebp - 4]
mov dword [ecx], eax
jmp 0x404cf9
mov eax, dword [0x4690b8]
push 0x454130
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x404cf9
mov eax, dword [ebp - 4]
cmp eax, dword [0x4690b4]
jge 0x404cf9
mov eax, dword [0x4690b8]
push 0x454134
push dword [eax + esi*4 + 4]
call ebx
test eax, eax
je 0x404d5a
inc edi
inc dword [ebp - 4]
cmp edi, dword [0x4690b4]
jl 0x404c5c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 8]
lea ecx, [edi + 2]
mov byte [eax], 1
cmp ecx, dword [0x4690b4]
jge 0x404d5a
mov eax, dword [0x4690b8]
push dword [eax + edi*4 + 4]
mov esi, dword [eax + ecx*4]
call fcn.0043b23c
pop ecx
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x404d0b

Function at 0x40508a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4050b8
test al, 0x10
jne 0x4050b8
test al, 1
je 0x4050b8
xor eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne bl
mov al, bl
pop ebx
pop ebp
ret
Function at 0x4050bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40513e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x40512a
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.0043b28d
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call esi
test eax, eax
je 0x40512a
push edi
call fcn.0043b5e1
pop ecx
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
cmp edi, ebx
je 0x40513e
mov eax, dword [ebp - 4]
mov byte [edi + eax], bl
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x40516f
Capabilities:
Delete directory
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x56c
push ebx
push esi
push edi
mov edi, 0x103
push edi
xor esi, esi
lea eax, [ebp - 0x45f]
push esi
push eax
mov byte [ebp - 0x460], 0
call fcn.0043bbc0
push edi
lea eax, [ebp - 0x24f]
push esi
push eax
mov byte [ebp - 0x250], 0
call fcn.0043bbc0
push edi
lea eax, [ebp - 0x357]
push esi
push eax
mov byte [ebp - 0x358], 0
call fcn.0043bbc0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0x24
lea esi, [edi + 1]
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
call ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push eax
call ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x250]
push eax
call ebx
xor ebx, ebx
push 0x13c
lea eax, [ebp - 0x144]
push ebx
push eax
mov dword [ebp - 0x148], ebx
call fcn.0043bbc0
lea eax, [ebp - 0x358]
push eax
call fcn.004023b0
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40527a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x567]
push ebx
push eax
mov byte [ebp - 0x568], bl
call fcn.0043bbc0
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x568]
push eax
push ebx
push dword [ebp - 4]
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
inc eax
jmp 0x405322
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ebp - 0x148]
push ecx
push eax
mov dword [ebp - 8], 1
call ebx
test eax, eax
je 0x405304
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x454238
cmp byte [ebp - 0x11c], 0x2e
je 0x4052ee
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push edi
push eax
call esi
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x250]
push edi
push eax
call esi
add esp, 0x20
push 1
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x405300
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4052a0
jmp 0x405304
and dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 8], 0
je 0x40531f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a95
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.0043bbc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocStringLen
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x405b0a
xor eax, eax
jmp 0x405c59
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push 0x3c
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x405c45
mov eax, dword [ebp - 0x14]
push ebx
add eax, 0x18
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x405b88
sub dword [ebp - 8], 0xffffff80
jmp 0x405b9f
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x405b9c
add dword [ebp - 8], 0x90
jmp 0x405b9f
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x405c45
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call edi
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x405c45
push ebx
push ebx
add eax, 0xfffffff0
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], ebx
jne 0x405c45
cmp dword [ebp - 0x2c], ebx
jne 0x405c45
cmp dword [ebp - 0x28], ebx
jne 0x405c45
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x405c45
mov edi, dword [ebp + 0xc]
push eax
mov dword [edi], eax
call fcn.0043b28d
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [edi]
push ebx
push ebx
sub eax, 0x10
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx], ebx
pop esi
setne al
pop edi
pop ebx
leave
ret
Function at 0x406d8c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x406f29
cmp dword [ebp + 0x10], ebx
je 0x406f29
cmp esi, ebx
je 0x406e0c
mov ecx, dword [esi]
cmp ecx, ebx
jne 0x406dbd
cmp dword [esi + 8], ebx
je 0x406e0c
xor eax, eax
cmp ecx, ebx
je 0x406de1
cmp dword [esi + 4], ebx
je 0x406de1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406d42
add esp, 0xc
cmp eax, ebx
jne 0x406f2b
cmp dword [esi + 8], ebx
je 0x406f2b
cmp dword [esi + 0xc], ebx
je 0x406f2b
push dword [ebp + 0x10]
lea esi, [esi + 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406d42
add esp, 0xc
jmp 0x406f2b
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0043bbc0
add esp, 0xc
push str.theme_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.00402362
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406e41
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x406e51
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocStringLen
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406ee7
push str.data_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.00402362
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406ea1
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x406eb1
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocStringLen
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x406f29
push ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
inc eax
push eax
call fcn.0043b28d
pop ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
mov byte [eax + ecx], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x406f2b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret