joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x20002
push 8
push dword [0x4263c8]
call edi
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x14], ebx
je 0x403e49
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push ebx
push eax
push eax
push eax
call esi
test eax, eax
jbe 0x403e42
lea ecx, [eax + 1]
mov eax, ebx
call fcn.0040c941
test al, al
je 0x403e42
push 0xc0c
push 8
push dword [0x4263c8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x403e42
lea eax, [edi + 0x3fc]
mov dword [ebp - 8], eax
add eax, 0x1fe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push eax
mov edx, str.connections
mov dword [ebp - 4], ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x34]
push eax
mov edx, str.default
call fcn.004057af
pop ecx
lea eax, [ebp - 0x24]
push eax
mov edx, 0x40fa4c
call fcn.004057af
pop ecx
lea eax, [ebp - 0x48]
push eax
mov edx, str.username
call fcn.004057af
pop ecx
lea eax, [ebp - 0x5c]
push eax
mov edx, str.password
call fcn.004057af
pop ecx
mov ebx, 0xff
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403e22
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403e22
push dword [ebp + 8]
push ebx
push edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp + 8]
lea eax, [edi + 0x1fe]
push ebx
push eax
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp + 8]
lea eax, [ebp - 0x5c]
push ebx
push dword [ebp - 8]
push 0
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp - 8]
call fcn.00403b06
test eax, eax
pop ecx
jle 0x403e22
lea eax, [ebp - 0x94]
push eax
mov edx, str.ftp:___s:_s__s_n
call fcn.004057af
pop ecx
push edi
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x94]
push eax
mov edx, 0x307
call fcn.0040c8c5
add esp, 0x10
test eax, eax
jle 0x403e1f
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0040c4d7
test al, al
pop ecx
je 0x403e1f
inc dword [edi + 4]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push 1
call fcn.0040c961
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x403d57
push edi
call fcn.0040c306
mov ebx, dword [ebp - 0x14]
pop ecx
push ebx
call fcn.0040c306
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e9f
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0040c369
lea eax, [ebp - 0x100]
mov ebx, str.SOFTWAREGhislerTotal_Commander
push eax
mov edx, ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x6c]
push eax
mov edx, str.ftpininame
call fcn.004057af
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x100]
push eax
lea edi, [ebp - 0x308]
mov eax, 0x80000001
call fcn.00408942
add esp, 0xc
cmp eax, 0xffffffff
je 0x403f38
test eax, eax
jbe 0x403f38
push esi
lea eax, [ebp - 0x510]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.00403c79
pop ecx
pop ecx
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [ebp - 8], 0
jne 0x40408d
lea eax, [ebp - 0x40]
push eax
mov edx, str.totalcmd
call fcn.004057af
pop ecx
lea eax, [ebp - 0x9c]
push eax
mov edx, str.totalcommander
call fcn.004057af
pop ecx
lea eax, [ebp - 0x54]
push eax
mov edx, str.ghisler
call fcn.004057af
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
pop ecx
mov dword [ebp - 0x28], 0x24
mov dword [ebp - 0x24], 0x1a
mov dword [ebp - 0x20], 0x26
mov dword [ebp - 0x1c], 0x23
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp + eax*4 - 0x28]
lea eax, [ebp - 0x308]
push eax
xor eax, eax
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40400e
cmp edi, 0x24
jne 0x403fe9
xor edi, edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.00403c32
add esp, 0xc
mov word [ebp - 0x302], di
jmp 0x403feb
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x403e4e
push 2
push 3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004086fb
add esp, 0x24
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x403fa7
cmp dword [ebp - 8], 0
jne 0x40408d
lea eax, [ebp - 0xb8]
push eax
mov edx, ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x40]
push eax
mov edx, str.installdir
call fcn.004057af
pop ecx
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb8]
push eax
lea edi, [ebp - 0x308]
mov eax, 0x80000001
call fcn.00408942
add esp, 0xc
cmp eax, 0xffffffff
je 0x404089
test eax, eax
jbe 0x404089
push esi
lea eax, [ebp - 0x510]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.00403c32
add esp, 0xc
cmp dword [ebp - 8], 0
jbe 0x404099
mov esi, dword [ebp - 0xc]
call fcn.0040362f
jmp 0x4040a2
push dword [ebp - 0xc]
call fcn.0040c306
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404376
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x30]
push edi
push eax
mov edx, str.filezilla
call fcn.004057af
pop ecx
lea eax, [ebp - 0x30]
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0040c369
xor edi, edi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4043f6
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x4040a7
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004086fb
add esp, 0x24
inc edi
cmp edi, 3
jb 0x4043bb
cmp dword [ebp - 4], esi
jbe 0x40440b
mov esi, dword [ebp - 8]
call fcn.0040362f
jmp 0x404414
push dword [ebp - 8]
call fcn.0040c306
pop ecx
pop edi
pop esi
leave
ret

Function at 0x404418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.0040c342
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
or cl, 0x50
xor eax, eax
test dl, dl
mov byte [ebp - 2], 0
je 0x40446c
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx dx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x404459
pop esi
and word [edi + eax*2], 0
leave
ret
Function at 0x404701
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.0040c830
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x4047b3
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.0040c6ff
test al, al
je 0x4047b3
xor eax, eax
test esi, esi
jle 0x40474a
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x40473d
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x404763
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x404769
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x4047b3
cmp eax, dword [ebp + 8]
jl 0x4047b3
cmp byte [ebp - 0x100], 0xff
jne 0x404795
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x4047ac
movzx si, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x40479e
and word [edi + eax*2], 0
jmp 0x4047b5
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x404d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
lea eax, [ebp - 0x38]
push edi
push eax
mov edx, str.ftpcommander
call fcn.004057af
pop ecx
lea eax, [ebp - 0x38]
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0040c369
xor edi, edi
lea eax, [ebp - 0x240]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x404db0
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x404a6a
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.004086fb
add esp, 0x24
inc edi
cmp edi, 3
jb 0x404d75
cmp dword [ebp - 4], esi
jbe 0x404dc5
mov esi, dword [ebp - 8]
call fcn.0040362f
jmp 0x404dce
push dword [ebp - 8]
call fcn.0040c306
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4053d4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
push 8
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.0040c369
lea eax, [ebp - 0x128]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settingsgeneral_favorites
call fcn.004057af
lea eax, [ebp - 0xb8]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settings_backup
call fcn.004057af
lea eax, [ebp - 0x54]
push eax
mov edx, str.personal_favorites
call fcn.004057af
lea eax, [ebp - 0x2c]
push eax
mov edx, str.folder
call fcn.004057af
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
mov ebx, 0x104
push ebx
push dword [ebp + esi - 0x14]
lea edi, [ebp - 0x330]
push dword [ebp + esi - 0x1c]
mov eax, 0x80000001
call fcn.00408942
add esp, 0xc
cmp eax, 0xffffffff
je 0x4054a1
test eax, eax
jbe 0x4054a1
push ebx
lea eax, [ebp - 0x538]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x538]
push eax
call fcn.00405119
pop ecx
pop ecx
add esi, 4
dec dword [ebp - 4]
jne 0x405459
cmp dword [ebp - 8], 0
jbe 0x4054b9
mov esi, dword [ebp - 0xc]
call fcn.0040362f
jmp 0x4054c2
push dword [ebp - 0xc]
call fcn.0040c306
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406ebc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x406eef
xor eax, eax
jmp 0x406f24
push edi
push dword [ebp + 0x14]
call fcn.004056ef
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
pop esi
leave
ret

Function at 0x4071d3
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4071e5
xor eax, eax
pop esi
ret
push esi
push esi
push esi
push 1
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [0x4124e4], eax
pop esi
mov eax, ecx
ret
Function at 0x407bce
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.0040da80
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
lea eax, [esp + 0x10]
push eax
xor edi, edi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [esp + 0x1010], edi
je 0x407c14
push dword [esp + 0x1010]
lea eax, [esp + 0x10]
push eax
call fcn.00407a7b
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x407c88
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
lea eax, [esp + 0x814]
push eax
push dword [esi*4 + 0x412044]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x810]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00407a7b
test eax, eax
pop ecx
pop ecx
je 0x407c92
cmp eax, 1
jne 0x407c5e
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 4
jmp 0x407c71
cmp eax, 2
jne 0x407c79
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 5
call fcn.0040ac39
add esp, 0xc
inc esi
add edi, 0xf4240
cmp esi, 2
jl 0x407c1b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1000
ret
lea eax, [esi + 1]
jmp 0x407c87

Function at 0x407c97
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040da00
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x24
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop esi
jne 0x407ccf
leave
ret
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc eax
leave
ret
Function at 0x408001
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push esi
push edi
xor eax, eax
call fcn.0040770e
mov edi, eax
mov eax, dword [0x41b634]
test eax, eax
jne 0x40804d
lea eax, [esp + 0xd8]
push eax
xor eax, eax
push str.TimeCorr
inc eax
call fcn.004082de
test eax, eax
pop ecx
pop ecx
je 0x40804d
lea eax, [esp + 0xd8]
call fcn.004058c2
mov dword [0x41b634], eax
add eax, edi
xor edx, edx
mov ecx, 0x4b0
div ecx
lea esi, [esp + 0x70]
mov edi, eax
test edi, edi
jne 0x40806d
mov byte [esp + 0x70], 0x30
mov byte [esp + 0x71], al
jmp 0x4080ab
mov ecx, 0x3b9aca00
cmp edi, ecx
jae 0x408087
mov eax, ecx
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, eax
cmp edi, ecx
jb 0x408076
jmp 0x4080a5
xor edx, edx
mov eax, edi
div ecx
push 0xa
mov dl, al
imul eax, ecx
add dl, 0x30
sub edi, eax
mov byte [esi], dl
mov eax, ecx
xor edx, edx
pop ecx
div ecx
inc esi
mov ecx, eax
test ecx, ecx
jne 0x408087
mov byte [esi], cl
cmp byte [esp + 0x70], 0
mov edx, str.__scMMdj490_0_Osd
lea eax, [esp + 0x70]
je 0x4080c1
inc eax
cmp byte [eax], 0
jne 0x4080bb
mov cl, byte [edx]
mov byte [eax], cl
inc eax
inc edx
test cl, cl
jne 0x4080c1
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
lea eax, [esp + 0x70]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4080f9
lea ecx, [esp + 0x70]
sub eax, ecx
dec eax
mov edx, eax
cmp edx, edi
jle 0x408121
push edx
push ecx
lea ecx, [esp + 0x20]
push ecx
shl eax, 3
xor ecx, ecx
call fcn.0040c180
add esp, 0xc
lea eax, [esp + 8]
push eax
lea esi, [esp + 0x1c]
call fcn.0040c221
pop ecx
xor ecx, ecx
mov dl, byte [esp + ecx + 8]
mov al, dl
shr al, 4
cmp al, 0xa
movzx ax, al
jae 0x408149
add ax, 0x30
jmp 0x40814d
add ax, 0x57
mov word [ebx + ecx*4], ax
movzx eax, dl
and eax, 0x8000000f
jns 0x408160
dec eax
or eax, 0xfffffff0
inc eax
cmp al, 0xa
movzx ax, al
jae 0x40816e
add ax, 0x30
jmp 0x408172
add ax, 0x57
mov word [ebx + ecx*4 + 2], ax
inc ecx
cmp ecx, 0x10
jl 0x408132
mov word [ebx + 0x40], di
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40818a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040da80
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4081c0
lea edx, [ebp - 0x2000]
call fcn.004071b8
jmp 0x4081ce
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, str.System.log
lea eax, [ebp - 0x2000]
call fcn.0040578b
cmp dword [ebp + 8], edi
push 4
pop eax
je 0x4081e9
push 3
pop eax
push edi
push 2
push eax
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov dword [0x4120b4], eax
pop esi
mov eax, ecx
leave
ret
Function at 0x408214
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [0x4120b4], 0xffffffff
jne 0x408238
push 0
call fcn.0040818a
cmp dword [0x4120b4], 0xffffffff
pop ecx
jne 0x408238
xor eax, eax
leave
ret
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.004056ef
push dword [ebp + 0x10]
mov esi, eax
call fcn.004056ef
mov edx, dword [ebp + 0xc]
mov ebx, eax
lea eax, [ebp - 0x68]
push eax
call fcn.004057af
add esp, 0xc
push 0xa
pop ecx
cmp esi, ecx
jae 0x408276
sub ecx, esi
xor eax, eax
shr ecx, 1
lea edi, [ebp + esi*2 - 0x68]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
call fcn.004057af
pop ecx
push 0x32
lea eax, [ebx + 0xa]
pop ecx
cmp eax, ecx
jae 0x40829e
sub ecx, eax
lea edi, [ebp + eax*2 - 0x68]
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor esi, esi
xor eax, eax
xor byte [ebp + eax - 0x68], 0x78
inc eax
cmp eax, 0x64
jb 0x4082a2
mov eax, dword [ebp + 8]
imul eax, eax, 0x64
push esi
push esi
push eax
push dword [0x4120b4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push dword [0x4120b4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4082de
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
cmp dword [0x4120b4], 0xffffffff
push esi
mov esi, eax
jne 0x408301
push 1
call fcn.0040818a
cmp dword [0x4120b4], 0xffffffff
pop ecx
je 0x40836d
imul esi, esi, 0x64
push 0
push 0
push esi
push dword [0x4120b4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x6c]
push eax
push dword [0x4120b4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40836d
cmp dword [ebp - 4], 0x64
jne 0x40836d
xor eax, eax
xor byte [ebp + eax - 0x6c], 0x78
inc eax
cmp eax, 0x64
jb 0x408339
push dword [ebp + 8]
and word [ebp - 8], 0
lea eax, [ebp - 0x6c]
call fcn.00405731
pop ecx
lea ecx, [ebp - 0x6c]
cmp eax, ecx
jne 0x40836d
push dword [ebp + 0xc]
lea edx, [ebp - 0x58]
call fcn.004057af
xor eax, eax
pop ecx
inc eax
jmp 0x40836f
xor eax, eax
pop esi
leave
ret
Function at 0x4086fb
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push eax
mov eax, 0x40ff18
call fcn.004086cf
test al, al
pop ecx
pop ecx
je 0x408872
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x408872
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [ebp + 0x20], esi
je 0x40876a
push esi
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408869
cmp word [ebp - 0x230], 0x2e
jne 0x408798
cmp word [ebp - 0x22e], si
je 0x408851
cmp word [ebp - 0x22e], 0x2e
jne 0x408798
cmp word [ebp - 0x22c], si
je 0x408851
mov eax, dword [ebp - 0x25c]
and eax, 0x10
je 0x4087a9
test byte [ebp + 0x14], 2
jne 0x4087b3
cmp eax, esi
jne 0x4087f7
test byte [ebp + 0x14], 4
je 0x4087f7
cmp dword [ebp + 0x10], 0
jbe 0x4087f7
push dword [edi + esi*4]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x4087d5
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x4087b9
jmp 0x4087f7
push dword [ebp + 0x1c]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
add esp, 0xc
test al, al
je 0x408869
cmp dword [ebp + 0x28], 0
je 0x4087f7
push dword [ebp + 0x28]
call ebx
test byte [ebp - 0x25c], 0x10
je 0x408851
test byte [ebp + 0x14], 1
je 0x408851
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x230]
call fcn.004086cf
test al, al
pop ecx
pop ecx
je 0x408851
cmp dword [ebp + 0x24], 0
je 0x40882c
push dword [ebp + 0x24]
call ebx
push dword [ebp + 0x28]
lea eax, [ebp - 0x464]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push eax
call fcn.004086fb
add esp, 0x24
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40874e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408877
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x40890b
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x408902
cmp dword [ebp - 8], edi
jne 0x408902
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x4088c1
mov dword [esi], edi
mov al, 1
jmp 0x40890d
push 4
push 0x3000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, edi
mov dword [esi], eax
je 0x408902
push edi
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4088f4
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
je 0x4088bd
push 0x8000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
leave
ret

Function at 0x408942
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40897f
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 8]
call fcn.00408910
add esp, 0x10
mov ebx, eax
jmp 0x408982
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x4089f8
test bl, 1
jne 0x4089f8
cmp dword [ebp - 4], 1
je 0x408998
cmp dword [ebp - 4], 2
jne 0x4089f8
xor ecx, ecx
cmp ebx, ecx
jne 0x4089a3
mov word [edi], cx
jmp 0x4089f4
shr ebx, 1
dec ebx
mov eax, ebx
cmp word [edi + eax*2], cx
je 0x4089ba
inc eax
cmp dword [ebp + 0x10], eax
jbe 0x4089f8
mov word [edi + eax*2], cx
mov ebx, eax
cmp eax, 2
jbe 0x4089f4
cmp dword [ebp - 4], 2
jne 0x4089f4
push edi
call fcn.0040c49c
mov esi, eax
test esi, esi
pop ecx
je 0x4089e1
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4089e4
or ebx, 0xffffffff
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
jmp 0x4089fb
or eax, 0xffffffff
pop esi
pop ebx
leave
ret