joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403548
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
cmp dword [esp + 0x108], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x4035f3
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3eb
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esi + 0x20]
push ecx
push eax
call ebx
push 0x3ee
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x1c]
add ecx, 0x20
push ecx
push eax
call ebx
push 0x3ed
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x1c]
add ecx, 0x124
push ecx
push eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x1c]
add ecx, 0x430
push ecx
push eax
call ebx
push 0x3f2
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x1c]
add ecx, 0x534
push ecx
push eax
call ebx
mov eax, dword [esi + 0x1c]
push dword [eax + 0x638]
push 0x3f1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x4036f3
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push 0x3eb
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
push 0x400
push ecx
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x10]
push 0x104
push eax
lea eax, [esi + 0x20]
push eax
call ebp
push 0x3ec
push dword [esi + 4]
call edi
lea ecx, [esp + 0x10]
push 0x400
push ecx
push eax
call ebx
lea eax, [esp + 0x10]
push 0x104
push eax
mov eax, dword [esi + 0x1c]
add eax, 0x430
push eax
call ebp
push 0x3f2
push dword [esi + 4]
call edi
lea ecx, [esp + 0x10]
push 0x400
push ecx
push eax
call ebx
lea eax, [esp + 0x10]
push 0x104
push eax
mov eax, dword [esi + 0x1c]
add eax, 0x534
push eax
call ebp
push 0x3ee
push dword [esi + 4]
call edi
lea ecx, [esp + 0x10]
push 0x400
push ecx
push eax
call ebx
lea eax, [esp + 0x10]
push 0x104
push eax
mov eax, dword [esi + 0x1c]
add eax, 0x20
push eax
call ebp
push 0x3ed
push dword [esi + 4]
call edi
lea ecx, [esp + 0x10]
push 0x400
push ecx
push eax
call ebx
lea eax, [esp + 0x10]
push 0x104
push eax
mov eax, dword [esi + 0x1c]
add eax, 0x124
push eax
call ebp
push 0x3f1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ecx, dword [esi + 0x1c]
pop ebp
mov dword [ecx + 0x638], eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 4
Function at 0x4036ff
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x7f02
mov esi, ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3eb
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
lea ebp, [esi + 0x20]
push 0x104
push ebp
push eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x1c]
push 0x104
add ecx, 0x430
push ecx
push eax
call ebx
cmp byte [ebp], 0
je 0x4037e4
mov ecx, esi
call fcn.00402c4b
test eax, eax
jne 0x403783
push 1
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x403814
mov ecx, dword [esi + 0x1c]
call fcn.00402367
push 1
mov ebp, eax
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push ebp
push eax
call ebx
test ebp, ebp
jne 0x4037c4
push 0x10
push 0x41724c
push 0x4173b4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push dword [esi + 4]
call edi
push ebp
push eax
call ebx
jmp 0x4037f4
push 0x30
push str.WinPatch_Apply
push 0x41737c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push dword [esi + 4]
call edi
push 1
jmp 0x4037bf
push 1
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov ecx, esi
call fcn.00403548
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x403819
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x403827
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x403908
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4173e4]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4173e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4173e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4173e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4173e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4173e4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4173e4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4173e4]
xor eax, esi
inc edx
dec edi
jne 0x403844
pop ebx
cmp dword [ebp + 0x10], 0
je 0x403929
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4173e4]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x40390e
pop edi
pop esi
not eax
pop ebp
ret
Function at 0x404020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x20]
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x68]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x40404a
test ecx, ecx
jne 0x404054
test edx, edx
jne 0x404054
mov eax, edi
jmp 0x4040c0
cmp eax, 0xffffffff
jne 0x404054
push 0xfffffffffffffffe
pop eax
jmp 0x4040c0
mov edx, dword [esi + 0x20]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x4040c0
mov eax, dword [esi + 0x2c]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0040b870
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x64], edi
sub dword [esi + 0x60], edi
add esp, 0xc
sub dword [esi + 0x50], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x404085
mov eax, dword [esi + 0x34]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x4040a4
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x40411b
push eax
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x60]
add eax, dword [esi + 0x2c]
push eax
push ecx
call fcn.00404120
add dword [esi + 0x68], eax
mov ebx, dword [esi + 0x68]
add esp, 0xc
cmp ebx, 3
jb 0x404107
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x2c]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x4c]
movzx eax, byte [edx]
mov dword [esi + 0x3c], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x48]
mov dword [esi + 0x3c], eax
cmp ebx, 0x106
jae 0x40411b
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x40402c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40521f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [str.oldptch]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x41791c]
xor ebx, ebx
push esi
cmp dword [ebp + 8], ebx
push edi
mov esi, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
jne 0x4052b5
lea eax, [ebp - 4]
push ebx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x14]
push 8
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040b1d0
pop ecx
test eax, eax
pop ecx
je 0x405276
xor eax, eax
jmp 0x4052b8
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [esi + 8]
push 4
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [esi + 0xc]
push 4
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [esi + 0x10]
push 4
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4052bf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [str.newptch]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x417924]
xor ebx, ebx
push esi
cmp dword [ebp + 8], ebx
push edi
mov esi, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
jne 0x40536e
lea eax, [ebp - 4]
push ebx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x14]
push 8
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040b1d0
pop ecx
test eax, eax
pop ecx
je 0x40531a
xor eax, eax
jmp 0x405371
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [esi + 8]
push 4
push eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
lea eax, [ebp - 4]
push 0
lea ebx, [esi + 0xc]
push eax
mov eax, dword [esi]
push 4
push ebx
push dword [eax + 0x20c]
call edi
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push dword [eax + 0x20c]
call edi
push 1
push 0
push dword [ebx]
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push dword [eax + 0x20c]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405378
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
mov eax, dword [esi]
push 1
push ebx
push ebx
mov dword [ebp - 8], ebx
push dword [eax + 0x20c]
call edi
mov eax, dword [esi]
push ebx
push ebx
push dword [esi + 0x10]
push dword [eax + 0x20c]
call edi
push ebx
push ebx
push dword [esi + 8]
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x405420
mov edi, 0xfa00
cmp dword [ebp - 4], edi
lea eax, [ebp - 8]
push ebx
push eax
jle 0x4053ea
mov eax, dword [esi]
push edi
push dword [0x4192d4]
push dword [eax + 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push ebx
push eax
push edi
jmp 0x405409
push dword [ebp - 4]
mov eax, dword [esi]
push dword [0x4192d4]
push dword [eax + 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp - 4]
push dword [0x4192d4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp - 4], edi
cmp dword [ebp - 4], ebx
jg 0x4053c3
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40542a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, ecx
push edi
push edi
push dword [esi + 8]
mov dword [ebp - 8], edi
push dword [ebp + 8]
call ebx
push edi
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
call ebx
mov esi, dword [esi + 0x10]
cmp esi, edi
mov dword [ebp - 4], esi
jle 0x4054b3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfa00
cmp dword [ebp - 4], esi
lea eax, [ebp - 8]
push edi
push eax
jle 0x405486
push esi
push dword [0x4192d4]
push dword [ebp + 8]
call ebx
lea eax, [ebp - 8]
push edi
push eax
push esi
jmp 0x40549c
push dword [ebp - 4]
push dword [0x4192d4]
push dword [ebp + 8]
call ebx
lea eax, [ebp - 8]
push edi
push eax
push dword [ebp - 4]
push dword [0x4192d4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp - 4], esi
cmp dword [ebp - 4], edi
jg 0x405468
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4058df
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x28]
mov ebx, ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor esi, esi
push esi
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x40591c
lea edi, [ebx + 0x1c]
jmp 0x405a1f
push dword [ebp + 0xc]
lea eax, [ebp - 0x334]
mov dword [ebp - 4], esi
push eax
call fcn.0040a8e0
push 0x104
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0040a880
lea eax, [ebp - 0x3fc]
add esp, 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x334]
push eax
call fcn.0040a9d0
pop ecx
mov ebx, eax
cmp ebx, 0xffffffff
jle 0x405970
cmp byte [ebp + ebx - 0x334], 0x5c
je 0x40596d
dec ebx
jmp 0x40595b
cmp ebx, 0xffffffff
je 0x4059ca
push 0x104
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0040a880
lea eax, [ebp - 0x334]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040bc20
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.0040a8e0
add esp, 0x20
lea eax, [ebp - 0x230]
push esi
push eax
call edi
test eax, eax
jne 0x4059d3
mov eax, dword [ebp - 0xc]
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
mov dword [eax], ebx
jmp 0x40594c
mov eax, dword [ebp - 8]
add eax, 0x1c
push eax
jmp 0x405a44
mov eax, dword [ebp - 4]
cmp eax, esi
jle 0x405a0f
lea ebx, [ebp + eax*4 - 0x400]
mov eax, dword [ebx]
dec dword [ebp - 4]
push eax
lea eax, [ebp - 0x230]
push dword [ebp + 0xc]
sub ebx, 4
push eax
call fcn.0040bc20
add esp, 0xc
lea eax, [ebp - 0x230]
push esi
push eax
call edi
test eax, eax
je 0x4059ca
cmp dword [ebp - 4], esi
jg 0x4059e1
push esi
push dword [ebp + 0xc]
call edi
test eax, eax
mov eax, dword [ebp - 8]
je 0x4059cd
lea edi, [eax + 0x1c]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 8]
cmp eax, esi
mov dword [ecx], eax
je 0x405a43
cmp eax, 0xffffffff
jne 0x405a71
push edi
lea eax, [ebp - 0x12c]
push 0x4170ac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x12c]
push esi
push 0x41709c
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x405a74
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405a7b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x405b4c
cmp esi, 0xffffffff
je 0x405b4c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
je 0x405acf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405b71
cmp ecx, ebx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jle 0x405b36
mov eax, dword [0x4192d4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfa00
cmp dword [ebp + 8], esi
lea ecx, [ebp - 0xc]
push ebx
push ecx
jle 0x405b03
push esi
push eax
push dword [ebp - 4]
call edi
mov dword [ebp + 0xc], esi
jmp 0x405b12
push dword [ebp + 8]
push eax
push dword [ebp - 4]
call edi
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov eax, dword [0x4192d4]
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
jle 0x405b2d
movzx edx, byte [eax + ecx]
add dword [ebp - 8], edx
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x405b1e
xor ebx, ebx
sub dword [ebp + 8], esi
cmp dword [ebp + 8], ebx
jg 0x405aed
pop edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [ebp + 0x10]
sete al
jmp 0x405b73
push dword [ebp + 8]
mov esi, 0x4191d0
push str.IsItTheSameFile_failed_for_file:_n_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push 0x41709c
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x405b79
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea esi, [ecx + 0x1c]
push edi
lea eax, [ebp - 0x114]
push esi
push eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], esi
call fcn.0040a8e0
lea eax, [ebp - 0x114]
push 0x417b48
push eax
call fcn.0040a8f0
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call fcn.0040a8f0
lea eax, [ebp - 0x114]
push eax
call fcn.0040a9d0
add esp, 0x1c
xor edi, edi
mov ebx, 0x80
push edi
push ebx
push 3
push edi
push 1
push 0x80000000
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call esi
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x405ca5
cmp eax, 0xffffffff
je 0x405ca5
push edi
push ebx
push 2
push edi
push edi
lea eax, [ebp - 0x114]
push 0x40000000
push eax
call esi
cmp eax, edi
mov dword [ebp - 4], eax
je 0x405c9c
cmp eax, 0xffffffff
je 0x405c9c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], edi
mov eax, dword [eax + 0x224]
cmp eax, edi
mov dword [ebp + 8], eax
jle 0x405c87
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfa00
cmp dword [ebp + 8], esi
lea eax, [ebp - 8]
push edi
push eax
jle 0x405c5a
push esi
push dword [0x4192d4]
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 8]
push edi
push eax
push esi
jmp 0x405c70
push dword [ebp + 8]
push dword [0x4192d4]
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 8]
push edi
push eax
push dword [ebp + 8]
push dword [0x4192d4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp + 8], esi
cmp dword [ebp + 8], edi
jg 0x405c3c
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push 1
pop eax
jmp 0x405ccc
lea eax, [ebp - 0x114]
push eax
jmp 0x405ca8
push dword [ebp - 4]
mov esi, 0x4191d0
push str.BackupFile_failed_for_file:_n_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
push 0x41709c
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405cd3
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, 0x80
push ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 3
push ebx
push 1
push 0x80000000
mov dword [esp + 0x38], ecx
push dword [esp + 0x40]
call ebp
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x405d79
cmp eax, 0xffffffff
je 0x405d79
push ebx
push esi
push 2
push ebx
push ebx
push 0x40000000
push dword [esp + 0x44]
call ebp
mov edi, eax
mov dword [esp + 0x18], ebx
cmp edi, ebx
je 0x405d2a
cmp edi, 0xffffffff
jne 0x405d85
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
mov dword [esp + 0x1c], eax
je 0x405d85
push esi
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push esi
push 2
push ebx
push ebx
push 0x40000000
push dword [esp + 0x44]
mov dword [esp + 0x34], 1
call ebp
mov edi, eax
cmp edi, ebx
je 0x405d6b
cmp edi, 0xffffffff
jne 0x405d85
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], eax
jle 0x405dfa
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0xfa00
cmp dword [esp + 0x28], esi
lea eax, [esp + 0x10]
push ebx
push eax
jle 0x405dc9
push esi
push dword [0x4192d4]
push dword [esp + 0x24]
call ebp
lea eax, [esp + 0x10]
push ebx
push eax
push esi
jmp 0x405de3
push dword [esp + 0x30]
push dword [0x4192d4]
push dword [esp + 0x24]
call ebp
lea eax, [esp + 0x10]
push ebx
push eax
push dword [esp + 0x30]
push dword [0x4192d4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [esp + 0x28], esi
cmp dword [esp + 0x28], ebx
jg 0x405da7
mov eax, dword [esp + 0x20]
lea ecx, [eax + 4]
push ecx
lea ecx, [eax + 0xc]
add eax, 0x14
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
cmp dword [esp + 0x18], ebx
je 0x405e34
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
jmp 0x405d7b
Function at 0x410781
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4188b0
cmp edx, dword [eax]
je 0x4107a3
add eax, 8
inc ecx
cmp eax, 0x418940
jl 0x410794
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4188b0]
jne 0x4108d1
mov eax, dword [0x41ad40]
cmp eax, 1
je 0x4108ab
test eax, eax
jne 0x4107d4
cmp dword [0x4183cc], 1
je 0x4108ab
cmp edx, 0xfc
je 0x4108d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41080b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040a8e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040a9d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41084e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040a9d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x415868
push edi
call fcn.0040bc20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040a8e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a8f0
lea eax, [ebp - 0xa0]
push 0x415848
push eax
call fcn.0040a8f0
push dword [esi + 0x4188b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a8f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004129c7
add esp, 0x2c
pop edi
jmp 0x4108d1
lea eax, [ebp + 8]
lea esi, [esi + 0x4188b4]
push 0
push eax
push dword [esi]
call fcn.0040a9d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219