joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x404ada
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x404a23
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403184
jmp 0x404ac1
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00404984
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004049a4
mov ebx, eax
test esi, esi
je 0x404a4b
dec esi
test esi, esi
jl 0x404a4b
cmp edi, ebx
jne 0x404a2a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031c4
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403464
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
cmp eax, 2
jl 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ae1
lea eax, [ebp - 0x110]
call fcn.00403094
ret

Function at 0x404b9c
Capabilities:
Get file attributes

Disassembly:
call fcn.00404490
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404bb0
dec eax
and al, 0x10
sete al
ret

Function at 0x404cf8
Capabilities:
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404d07
dec eax
and al, 0x10
setne al
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405001
lea eax, [ebp - 0x10c]
call fcn.00403094
ret

Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x405080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
mov eax, dword [ebp - 8]
call fcn.004033fc
xor eax, eax
push ebp
push 0x4051db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x4050ee
mov eax, dword [ebp - 4]
call fcn.0040320c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4050ee
lea eax, [ebp - 4]
mov edx, 0x4051f0
call fcn.00403214
cmp dword [ebp - 8], 0
je 0x40511d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40511d
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404728
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040340c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4051a6
test dword [ebp - 0x14c], 0x10
ja 0x405193
cmp dword [ebx], 0
je 0x405166
mov eax, ebx
mov edx, 0x4051fc
call fcn.00403214
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031f4
push dword [ebp - 0x154]
mov eax, ebx
mov edx, 3
call fcn.004032cc
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405149
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051e2
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret
Function at 0x405634
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov ebx, eax
pushal
call fcn.004052d8
call fcn.0040456c
mov dword [ebx + 0x18], eax
popal
pushal
lea eax, [ebx + 0x1c]
call fcn.004030e8
popal
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40574c
pushal
lea edx, [ebx + 0x1c]
mov eax, dword [edx]
call fcn.00404db8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x4056a9
call fcn.00405c80
mov dword [ebx + 0x20], eax
popal
pushal
push ecx
xchg ecx, eax
mov edx, 0x40569b
call fcn.004048d8
test al, al
pop edx
jne 0x405691
mov edx, 0x4056a7
mov eax, dword [ebx + 0x20]
call fcn.00405cac
jmp 0x4056a9
popal
add esp, 0xfffffec0
xor edx, edx
push edx
push edx
xchg ecx, eax
mov edx, esp
call fcn.00405300
lea eax, [esp + 4]
mov edx, dword [ebx + 0x1c]
pop ecx
push ecx
call fcn.00403258
call fcn.004044a8
pop eax
mov edx, esp
push eax
push edx
push eax
call sub.kernel32.dll_FindFirstFileA
mov edi, eax
inc eax
mov eax, esp
pushfd
call fcn.00403094
popfd
pop ecx
je 0x405746
mov ecx, dword [esp]
push dword [ebp + 8]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040536c
test al, al
je 0x405735
mov ecx, dword [ebx + 0x24]
jecxz 0x405717
mov eax, dword [ebx + 0x28]
mov ecx, esp
push 1
mov edx, esp
push edx
mov edx, ebx
call dword [ebx + 0x24]
pop ecx
jecxz 0x405735
loop 0x405746
mov eax, 0x140
push eax
call fcn.00402448
push eax
xchg edx, eax
mov eax, dword [ebx + 0x18]
call fcn.004045e8
pop edx
pop ecx
mov eax, esp
call fcn.0040254c
push esp
push edi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4056e9
push edi
call sub.kernel32.dll_FindClose
add esp, 0x140
xor eax, eax
xchg dword [ebx + 0x20], eax
call fcn.00404520
pop edi
pop ebx
pop ebp
ret 4

Function at 0x406218
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.00406144
je 0x40625d
mov eax, ebx
push edx
call fcn.0040648c
pop edx
cmp eax, edx
je 0x40625d
test edx, edx
mov eax, ebx
jne 0x40623c
pop ebx
inc edx
jmp fcn.0040647c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x406245
dec edx
push edx
xor edx, edx
call fcn.0040647c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.00405f98
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040627c
ret
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x406e4e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x98]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406e1a
cmp byte [ebp - 1], 0
je 0x406dbe
lea eax, [ebp + esi - 0x98]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
jne 0x406e17
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x98]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
jmp 0x406e17
mov esi, ebx
and esi, 0xff
mov al, byte [ebp + esi - 0x98]
call fcn.0040258c
cmp al, 0x41
je 0x406e17
mov al, byte [ebp + esi - 0x98]
call fcn.0040258c
cmp al, 0x42
je 0x406e17
lea eax, [ebp + esi - 0x98]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406e17
lea eax, [ebp - 0xa0]
mov dl, byte [ebp + esi - 0x98]
call fcn.004031b4
mov edx, dword [ebp - 0xa0]
mov eax, edi
call fcn.00403214
add bl, 4
mov esi, ebx
and esi, 0xff
cmp byte [ebp + esi - 0x98], 0
jne 0x406d85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e55
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.004030b8
ret

Function at 0x4070d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070f1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x4070e1
pop esi
pop ebx
ret
Function at 0x4079f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x407b0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4091e0
mov ecx, 0xb
mov edx, 0xb
call fcn.004070d0
lea eax, [ebp - 8]
mov edx, 0x4091e0
mov ecx, 0xb
call fcn.004031f4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.00404f90
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00403258
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
mov eax, ebx
mov edx, 0x40a698
mov ecx, 0xa200
call fcn.00404bf8
test eax, eax
je 0x407aef
push 1
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov eax, 0x4091ec
mov ecx, 0x1a
mov edx, 0x1a
call fcn.004070d0
lea eax, [ebp - 0x10]
mov edx, 0x4091ec
mov ecx, 0x1a
call fcn.004031f4
mov edx, dword [ebp - 0x10]
mov eax, 0x80000000
call fcn.0040575c
mov ebx, eax
mov eax, 0x409208
mov ecx, 8
mov edx, 8
call fcn.004070d0
lea eax, [ebp - 0x18]
mov edx, 0x409208
mov ecx, 8
call fcn.004031f4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403258
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, ebx
call fcn.0040578c
mov eax, ebx
call fcn.004057cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407b11
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret
Function at 0x407c1c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0x407c25
mov eax, dword [ebp - 4]
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 0xa21c], edx
mov dword [ebp - 0xa218], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa218]
mov edx, 0x4091c0
mov ecx, 3
call fcn.004031f4
mov edx, dword [ebp - 0xa218]
mov eax, dword [ebp - 4]
call fcn.00407034
test al, al
je 0x407df4
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0040258c
add al, 0xbf
sub al, 2
jb 0x407df4
sub al, 0x19
je 0x407df4
lea eax, [ebp - 0x14]
mov dl, 1
call fcn.00406d40
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0040258c
mov edx, eax
lea eax, [ebp - 0xa21c]
call fcn.004031b4
mov eax, dword [ebp - 0xa21c]
mov edx, dword [ebp - 0x14]
call fcn.004034ec
test eax, eax
jne 0x407df4
mov eax, dword [ebp - 4]
call fcn.00407b18
mov eax, dword [ebp - 4]
call fcn.00407180
test al, al
je 0x407df4
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
test dword [ebp - 8], 1
jbe 0x407d1d
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00405b84
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407dd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405974
lea edx, [ebp - 0xa214]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.00405988
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x9d42]
mov ecx, 4
call fcn.0040254c
lea eax, [ebp - 0xa214]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3e8
call fcn.004070d0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405974
lea edx, [ebp - 0xa214]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.0040598c
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407dd9
mov eax, dword [ebp - 0xc]
call fcn.00404520
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e29
lea eax, [ebp - 0xa21c]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0x14]
call fcn.00403094
lea eax, [ebp - 4]
call fcn.00403094
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret
Function at 0x402ad4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b46
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b1f
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ad4
test eax, eax
jne 0x402b31
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402b06
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x402b46
Function at 0x402f4a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f77
mov ecx, dword [0x424398]
push edi
add eax, ecx
push edi
push eax
mov dword [0x41710c], eax
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403075
cmp eax, edi
jl 0x40306e
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409020]
call ebx
test eax, eax
je 0x40306b
cmp dword [ebp - 4], esi
jne 0x40306b
push dword [ebp + 8]
add dword [0x41710c], esi
call fcn.00403075
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40306e
cmp dword [ebp + 0x10], edi
jne 0x40303a
cmp dword [ebp + 8], edi
jle 0x403066
mov esi, 0x4130c8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fea
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409020]
call ebx
test eax, eax
je 0x40306b
cmp edi, dword [ebp - 4]
jne 0x40306b
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403036
cmp dword [ebp + 0x14], edi
jne 0x403036
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41710c], eax
cmp dword [ebp + 8], 0
jg 0x402fdd
jmp 0x403066
push 0xfffffffffffffffe
jmp 0x40306d
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403045
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409020]
call ebx
test eax, eax
je 0x40306b
mov eax, dword [ebp - 4]
add dword [0x41710c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40306e
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403075
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x41710c]
mov edi, eax
sub esi, dword [0x40b03c]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x40324b
push dword [0x41f11c]
call fcn.00403288
push ebp
push ebp
push dword [0x40b03c]
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f118], esi
mov dword [0x417108], ebp
mov eax, dword [0x417110]
mov ebx, 0x4000
sub eax, dword [0x41f11c]
cmp eax, ebx
jg 0x4030e8
mov ebx, eax
mov esi, 0x4130c8
push ebx
push esi
call fcn.00403256
test eax, eax
je 0x403216
add dword [0x41f11c], ebx
mov dword [0x40b058], esi
mov dword [0x40b05c], ebx
cmp dword [0x424348], ebp
je 0x403179
cmp dword [0x4243e0], ebp
jne 0x403179
cmp dword [esp + 0x10], ebp
je 0x403146
mov eax, dword [0x41f118]
push ebp
sub eax, dword [0x41710c]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b03c]
mov dword [0x417108], eax
call fcn.00405e31
jmp 0x403179
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x403179
mov eax, dword [0x424344]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402ba5
push ebp
push 0x6f
push dword [0x424340]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b040
mov dword [0x40b060], 0x40b0c8
mov dword [0x40b064], 0x8000
call fcn.00405ef2
test eax, eax
jl 0x40321f
mov esi, dword [0x40b060]
mov eax, 0x40b0c8
sub esi, eax
je 0x4031e0
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40321b
cmp esi, dword [esp + 0x14]
jne 0x40321b
add dword [0x40b03c], esi
cmp dword [0x40b05c], ebp
jne 0x40310e
jmp 0x4031ec
cmp dword [0x40b05c], ebp
jne 0x40321f
cmp ebx, ebp
je 0x40321f
mov eax, dword [0x41710c]
mov ecx, eax
sub ecx, dword [0x40b03c]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030d2
push ebp
push ebp
push eax
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x403224
or eax, 0xffffffff
jmp 0x40324d
push 0xfffffffffffffffe
jmp 0x403221
push 0xfffffffffffffffd
pop eax
jmp 0x40324d
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x40324b
mov eax, dword [0x41f118]
push ebp
push ebp
push 0x113
push esi
mov dword [0x417108], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x40391b
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x42b000], 0
push ebx
push ebp
push esi
push edi
mov edi, pe_overlay
mov ebx, 0x42b000
je 0x40393a
push ebx
call fcn.00405a62
jmp 0x403940
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
mov esi, dword [0x424384]
test esi, esi
je 0x403993
mov ecx, dword [0x424348]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x424380]
add ecx, edx
dec esi
mov bp, word [ecx]
xor bp, ax
and ebp, edi
test bp, bp
je 0x403978
test esi, esi
jne 0x403962
jmp 0x403993
mov edx, dword [ecx + 2]
mov dword [0x423b20], edx
mov edx, dword [ecx + 6]
mov dword [0x4243e8], edx
lea edx, [ecx + 0xa]
mov dword [0x423b1c], edx
cmp dword [0x423b1c], 0
jne 0x4039ae
cmp di, 0xffff
jne 0x4039aa
mov edi, 0x3ff
jmp 0x403942
xor edi, edi
jmp 0x403942
movzx eax, word [ecx]
push eax
push ebx
call fcn.00405a49
push 0xfffffffffffffffe
push 0x423b40
call fcn.00405afd
push eax
push dword [0x420930]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x42436c]
mov esi, dword [0x424368]
test eax, eax
je 0x4039fb
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4039f2
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00405afd
add esi, 0x418
dec edi
jne 0x4039e2
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40539d
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422958], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4053c1
test al, 0x10
jne 0x4053c4
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422958
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4053ef
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405457
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004056da
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x40548b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243c8], eax
jmp 0x4055f4
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x4054a9
test eax, eax
je 0x4055a5
test byte [ebp + 0xc], 2
je 0x4055a5
mov esi, 0x421958
push edi
push esi
call sub.KERNEL32.dll_lstrcpyA
test ebx, ebx
je 0x4054c6
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054cc
push edi
call fcn.00405641
push 0x40900c
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40559b
cmp byte [ebp - 0x118], 0x2e
jne 0x405515
cmp byte [ebp - 0x117], 0x2e
je 0x40557e
cmp byte [ebp - 0x117], 0
je 0x40557e
lea eax, [ebp - 0x118]
push eax
push ebx
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x144]
test al, 0x10
je 0x405541
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40557e
push dword [ebp + 0xc]
push edi
call fcn.00405457
jmp 0x40557e
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405576
test byte [ebp + 0xc], 4
je 0x40556e
push edi
push 0xfffffffffffffff1
call fcn.00404ebd
push 0
push edi
call fcn.00405835
jmp 0x40557e
inc dword [0x4243c8]
jmp 0x40557e
push edi
push 0xfffffffffffffff2
call fcn.00404ebd
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054fa
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055a5
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x4055f4
cmp dword [ebp - 4], esi
jne 0x4055ba
inc dword [0x4243c8]
jmp 0x4055f4
push edi
call fcn.00405dc9
test eax, eax
je 0x4055f4
push edi
call fcn.004055fa
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4055ec
test byte [ebp + 0xc], 4
je 0x4055b2
push edi
push 0xfffffffffffffff1
call fcn.00404ebd
push esi
push edi
call fcn.00405835
jmp 0x4055f4
push edi
push 0xffffffffffffffe5
call fcn.00404ebd
pop edi
pop esi
leave
ret 8