joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088e0
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x41bb30
push esi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x416548
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x41bb10], eax
mov dword [ebp - 0x20], ebx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 4
push 0x2000
stosd dword es:[edi], eax
push 0x1fffffff
push ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x4089ee
lea eax, [ebp - 8]
push eax
call fcn.0040d764
pop ecx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
call fcn.0040826a
mov edi, eax
xor esi, esi
xor eax, eax
inc eax
mov ecx, esi
shl eax, cl
test edi, eax
je 0x4089a9
lea eax, [esi + 0x41]
mov word [ebp - 0x10], ax
push 0x3a
pop eax
mov word [ebp - 0xe], ax
xor eax, eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
push eax
call fcn.00408317
pop ecx
cmp eax, 2
jb 0x4089a9
cmp eax, 3
jbe 0x40899a
cmp eax, 6
jne 0x4089a9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040864e
pop ecx
pop ecx
inc esi
cmp esi, 0x1a
jl 0x408962
cmp byte [0x41a05f], bl
je 0x4089c9
lea eax, [ebp - 0x20]
push eax
push fcn.0040864e
push ebx
call fcn.00408385
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [ebp + 8]
sub ecx, eax
shr ecx, 4
push ecx
call fcn.00408773
pop ecx
pop ecx
push 0x8000
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408a8a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push 0x20119
push edi
push edi
push edi
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408b12
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x408b08
mov eax, dword [ebp - 4]
push edi
call fcn.00408cd8
mov esi, eax
pop ecx
cmp esi, edi
je 0x408b08
lea eax, [ebp - 4]
push eax
push esi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call ebx
test eax, eax
je 0x408afc
call fcn.00408de5
xor esi, esi
jmp 0x408b08
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x408b08
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x408b4d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20106
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408b9b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x409a50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push dword [ebp + 8]
mov eax, 0x104
call fcn.0040d834
pop ecx
test al, al
jne 0x409a6f
xor eax, eax
leave
ret
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x409ae5
push 0x228
lea eax, [ebp - 0x228]
push edi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push esi
mov dword [ebp - 0x22c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x409ad4
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x409ada
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x409ab2
jmp 0x409ae0
mov edi, dword [ebp - 0x224]
call fcn.00409a17
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x409ba4
Capabilities:
Terminate process

Disassembly:
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 8], eax
je 0x409bdd
push esi
push dword [esp + 0xc]
push 1
call fcn.00409aeb
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x409bdc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
neg edi
sbb edi, edi
neg edi
call fcn.00409a17
pop esi
mov eax, edi
pop edi
ret

Function at 0x409be1
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push esi
push edi
mov edi, 0x8000
push 0
mov eax, edi
call fcn.00408cd8
mov esi, eax
pop ecx
test esi, esi
je 0x409c1f
push 0
push edi
push esi
push 5
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x409c14
call fcn.00408de5
add edi, edi
jmp 0x409be8
test eax, eax
jns 0x409c1f
call fcn.00408de5
xor esi, esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x409ce8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x24], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
pop edi
sete al
leave
ret
Function at 0x409d14
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push dword [ebp + 8]
mov eax, 0xff
call fcn.0040d887
pop ecx
test al, al
jne 0x409d35
xor eax, eax
jmp 0x409e01
push 0x28
push dword [ebp + 0xc]
call fcn.0040d80d
pop ecx
pop ecx
test al, al
je 0x409d2e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
xor edi, edi
mov dword [ebp - 8], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x409dff
push edi
push 0xc816f97a
push 5
push 0x416594
call fcn.0040a2d3
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.0040c9f8
add esp, 0x1c
test eax, eax
je 0x409dff
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 4]
mov edi, eax
call fcn.0040d8da
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x409df7
push 0
push 0xe0ba2a91
push 0x32
push 0x41659c
call fcn.0040a2d3
movzx ecx, byte [ebp - 0x49]
push ecx
movzx ecx, byte [ebp - 0x4a]
push ecx
movzx ecx, byte [ebp - 0x4b]
push ecx
movzx ecx, byte [ebp - 0x4c]
push ecx
movzx ecx, byte [ebp - 0x4d]
push ecx
movzx ecx, byte [ebp - 0x4e]
push ecx
movzx ecx, byte [ebp - 0x4f]
push ecx
movzx ecx, byte [ebp - 0x50]
push ecx
movzx ecx, word [ebp - 0x52]
push ecx
movzx ecx, word [ebp - 0x54]
push ecx
push dword [ebp - 0x58]
push eax
push dword [ebp + 0xc]
call fcn.0040c95b
add esp, 0x44
mov esi, dword [ebp - 4]
call fcn.00408de5
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x409f8f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [ebp + 8]
mov edi, 0x104
mov eax, edi
call fcn.0040d834
xor esi, esi
pop ecx
test al, al
jne 0x409fb4
mov dword [ebp + 8], esi
push ebx
mov eax, edi
call fcn.0040d834
pop ecx
test al, al
jne 0x409fc3
xor ebx, ebx
cmp dword [ebp + 8], esi
jne 0x409fd0
cmp ebx, esi
jne 0x409fd0
xor eax, eax
jmp 0x40a038
push esi
push 0x64
pop eax
call fcn.0040d834
push 0x40
lea eax, [ebp - 0x54]
push esi
push eax
call sub.ntdll.dll_memset
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x10
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a036
mov esi, dword [ebp - 0xc]
call fcn.00409a17
mov esi, dword [ebp - 0x10]
call fcn.00409a17
mov esi, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a03d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 6
jb 0x40a08e
call fcn.0040d51d
test eax, eax
je 0x40a09a
call fcn.0040d67a
jmp 0x40a093
call fcn.0040d51d
test eax, eax
je 0x40a09a
xor esi, esi
inc esi
mov eax, esi
pop esi
leave
ret

Function at 0x40a73b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, 0x104
push edi
mov eax, esi
call fcn.0040d834
pop ecx
push ebx
mov eax, esi
call fcn.0040d834
pop ecx
test al, al
jne 0x40a769
xor ebx, ebx
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40a7f3
push 0x5e2d8bdf
push 3
push 0x41660c
call fcn.0040a71a
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40a7f3
lea esi, [ebp - 0x20c]
call fcn.0040a874
cmp ebx, edi
je 0x40a7e4
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x20c]
jmp 0x40a7cd
sub eax, 2
cmp word [eax], 0x2e
jne 0x40a7ca
cmp word [ebx], 0x2e
je 0x40a7dc
add eax, 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c7d3
pop ecx
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a874
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
push esi
mov eax, 0x104
call fcn.0040d834
pop ecx
test al, al
jne 0x40a890
xor eax, eax
jmp 0x40a8d4
push 0x80
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x40a8c0
mov ecx, edi
inc edi
cmp ecx, 0x14
jg 0x40a8d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
jne 0x40a8d4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040a7fa
pop ecx
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
test eax, eax
je 0x40a8a0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40a8d9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
mov eax, 0x104
call fcn.0040d834
pop ecx
test al, al
jne 0x40a8ef
xor eax, eax
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x40a904
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
mov eax, 0x104
call fcn.0040d887
pop ecx
test al, al
jne 0x40a91a
xor eax, eax
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x40a994
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1454
call sub.ntdll.dll__chkstk
push ebx
push esi
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
je 0x40ab82
push ebx
call fcn.00408cd8
mov esi, eax
pop ecx
cmp esi, ebx
je 0x40ab82
push esi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x32488f66
push 0x18
push 0x416610
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.0040a71a
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
add esp, 0xc
push eax
push esi
call edi
cmp dword [ebp - 8], 4
jb 0x40ab7d
push 0xf3dbcf32
push 8
push 0x41662c
call fcn.0040a71a
add esp, 0xc
push 0x36466aeb
push 0xc
push 0x416638
mov dword [ebp - 0x3c], eax
call fcn.0040a71a
add esp, 0xc
push 0xee4862a9
push 0xb
push 0x416648
mov dword [ebp - 0x38], eax
call fcn.0040a71a
add esp, 0xc
push 0xc72c32ef
push 0xb
push 0x416654
mov dword [ebp - 0x34], eax
call fcn.0040a71a
add esp, 0xc
push 0x1dd684f2
push 0xe
push 0x416660
mov dword [ebp - 0x30], eax
call fcn.0040a71a
add esp, 0xc
push 0xdfbbbbdd
push 0xe
push 0x416670
mov dword [ebp - 0x2c], eax
call fcn.0040a71a
add esp, 0xc
push 0x5faadde5
push 0xf
push 0x416680
mov dword [ebp - 0x28], eax
call fcn.0040a71a
add esp, 0xc
push 0x2adfb7eb
push 0xf
push 0x416690
mov dword [ebp - 0x24], eax
call fcn.0040a71a
add esp, 0xc
push 0x8526ced6
push 0xc
push 0x4166a0
mov dword [ebp - 0x20], eax
call fcn.0040a71a
add esp, 0xc
push 0x353f276a
push 0xb
push 0x4166b0
mov dword [ebp - 0x1c], eax
call fcn.0040a71a
add esp, 0xc
push 0x8c6b7963
push 0x10
push 0x4166bc
mov dword [ebp - 0x18], eax
call fcn.0040a71a
add esp, 0xc
push 0x62593d92
push 0xc
push 0x4166d0
mov dword [ebp - 0x14], eax
call fcn.0040a71a
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push ecx
push 0x2f14c6d8
push 0x1b
push 0x4166e0
call fcn.0040a71a
add esp, 0x10
push eax
lea eax, [ebp - 0x1450]
push eax
call fcn.0040c91e
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1450]
push eax
push esi
call edi
test eax, eax
je 0x40ab7d
push dword [ebp - 0xc]
call fcn.0040c7d3
pop ecx
mov ebx, eax
call fcn.00408de5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40ab89
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push esi
mov esi, eax
push edi
push esi
call fcn.0040d7e6
pop ecx
pop ecx
test al, al
jne 0x40ab9d
xor eax, eax
pop esi
ret
mov eax, edi
shr eax, 2
xor edx, edx
lea ecx, [esi + eax*4]
neg eax
je 0x40abce
mov esi, dword [ecx + eax*4]
imul esi, esi, 0xcc9e2d51
rol esi, 0xf
imul esi, esi, 0x1b873593
xor edx, esi
rol edx, 0xd
imul edx, edx, 5
add edx, 0xe6546b64
inc eax
jne 0x40abab
mov eax, edi
and eax, 3
xor esi, esi
dec eax
je 0x40abee
dec eax
je 0x40abe5
dec eax
jne 0x40ac04
movzx esi, byte [ecx + 2]
shl esi, 0x10
movzx eax, byte [ecx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [ecx]
xor eax, esi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, edi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop esi
ret

Function at 0x40ae30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
xor edx, edx
mov edi, eax
cmp esi, edx
je 0x40ae66
xor eax, eax
cmp dword [ebp + 0x14], edx
jbe 0x40ae66
push ebx
movzx ebx, byte [edx + esi]
mov ecx, eax
shl ecx, 3
shl ebx, cl
xor edi, ebx
inc edx
inc eax
and eax, 3
cmp edx, dword [ebp + 0x14]
jb 0x40ae4e
pop ebx
cmp dword [ebp + 0xc], 0
je 0x40ae82
mov esi, dword [ebp + 8]
dec dword [ebp + 0xc]
mov eax, edi
call fcn.0040ac29
mov byte [esi], al
inc esi
cmp dword [ebp + 0xc], 0
jne 0x40ae6f
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40bf88
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
call fcn.0040d7e6
pop ecx
pop ecx
test al, al
je 0x40c03d
push 0x10
push dword [ebp + 0x10]
call fcn.0040d80d
pop ecx
pop ecx
test al, al
je 0x40c03d
push dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
lea esi, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.0040b826
lea eax, [ebp - 0x54]
push eax
push 8
pop edx
lea ecx, [ebp - 0xc]
call fcn.0040bf53
pop ecx
pop ecx
mov ecx, dword [ebp - 0x54]
shr ecx, 3
push 0x38
and ecx, 0x3f
pop eax
cmp ecx, eax
jb 0x40c00e
push 0x78
pop eax
sub eax, ecx
push 0x419820
lea esi, [ebp - 0x64]
call fcn.0040b826
lea eax, [ebp - 0xc]
push eax
push 8
pop eax
call fcn.0040b826
mov ecx, dword [ebp + 0x10]
mov eax, esi
push eax
push 0x10
pop edx
call fcn.0040bf53
xor esi, esi
add esp, 0xc
inc esi
mov eax, esi
pop esi
leave
ret
Function at 0x40c042
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x74
push 0x416b38
call fcn.00414048
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edi
push 0xa0f2cde7
push 4
push 0x4166fc
call fcn.0040a703
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x40c142
cmp byte [edi], 0x2d
jne 0x40c0be
push 0x84612c2a
push 2
push 0x416704
call fcn.0040a703
add esp, 0xc
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrPBrkA]
cmp eax, ebx
je 0x40c142
sub eax, edi
add edi, eax
mov dword [ebp - 0x24], edi
sub dword [ebp - 0x1c], eax
mov byte [ebp - 0x80], bl
push 0x40
push ebx
lea eax, [ebp - 0x7f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], ebx
je 0x40c103
cmp esi, 0x40
jae 0x40c103
push dword [ebp - 0x30]
push edi
call dword [sym.imp.SHLWAPI.dll_StrSpnA]
add edi, eax
mov dword [ebp - 0x24], edi
sub dword [ebp - 0x1c], eax
je 0x40c103
mov al, byte [edi]
mov byte [ebp + esi - 0x80], al
inc esi
inc edi
mov dword [ebp - 0x24], edi
dec dword [ebp - 0x1c]
jmp 0x40c0d2
cmp esi, ebx
je 0x40c142
mov dword [ebp - 0x2c], esi
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x20]
push 1
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x40c142
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x28], eax
cmp dword [ebp - 0x20], ebx
je 0x40c082
add dword [ebp - 0x20], eax
jmp 0x40c082
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
call fcn.00414083
ret

Function at 0x40c1b7
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push 0x80000001
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x40c212
push ebx
mov ebx, dword [ebp - 4]
push esi
mov esi, ebx
test ebx, ebx
je 0x40c207
cmp byte [edi], 0xa
je 0x40c1f0
inc edi
dec esi
jmp 0x40c203
dec ebx
dec esi
je 0x40c207
push esi
lea eax, [edi + 1]
push eax
push edi
call dword [sym.imp.ntdll.dll_memmove]
add esp, 0xc
test esi, esi
jne 0x40c1e7
mov eax, dword [ebp + 0x10]
mov byte [ebx + eax], 0
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x40c215
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x41a060]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 8], eax
cmp dword [ebp + 8], ebx
je 0x40c289
cmp eax, ebx
je 0x40c289
push edi
lea ecx, [ebp - 4]
push ecx
push ebx
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edi, dword [ebp - 4]
cmp edi, ebx
je 0x40c24e
inc edi
push ebx
lea eax, [edi + 1]
call fcn.00408cd8
mov esi, eax
pop ecx
cmp esi, ebx
je 0x40c288
push esi
push dword [ebp - 8]
mov eax, edi
push dword [ebp + 8]
call fcn.0040c1b7
add esp, 0xc
cmp eax, ebx
jne 0x40c27c
call fcn.00408de5
xor esi, esi
jmp 0x40c288
mov ecx, dword [ebp + 0xc]
mov byte [eax + esi], bl
cmp ecx, ebx
je 0x40c288
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40cccd
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40ce80
push dword [ebp + 8]
mov eax, 0x104
call fcn.0040d834
pop ecx
test al, al
je 0x40ce80
mov eax, esi
shl eax, 2
push eax
push dword [ebp + 0xc]
call fcn.0040d7e6
pop ecx
pop ecx
test al, al
je 0x40ce80
push dword [ebp + 0x18]
call fcn.0040d7c9
pop ecx
test al, al
je 0x40ce80
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push eax
mov eax, 0x416544
call fcn.0040cc7c
pop ecx
pop ecx
test al, al
je 0x40ce80
push 0x250
lea eax, [ebp - 0x254]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x258], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40ce80
push ebx
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x228]
call fcn.0040cca8
test al, al
jne 0x40ce54
mov eax, dword [ebp - 0x254]
and eax, 0x10
je 0x40cdad
test bl, 2
jne 0x40cdb6
test eax, eax
jne 0x40cdfe
test bl, 4
je 0x40cdfe
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x40cdfe
mov eax, dword [ebp + 0xc]
push dword [eax + esi*4]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x40cddc
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x40cdbd
jmp 0x40cdfe
push dword [ebp + 0x1c]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
add esp, 0xc
test eax, eax
je 0x40ce6e
cmp dword [ebp + 0x24], 0
je 0x40cdfe
push dword [ebp + 0x24]
call edi
test byte [ebp - 0x254], 0x10
je 0x40ce54
test bl, 1
je 0x40ce54
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x228]
call fcn.0040cc7c
pop ecx
pop ecx
test al, al
je 0x40ce54
cmp dword [ebp + 0x20], 0
je 0x40ce32
push dword [ebp + 0x20]
call edi
push dword [ebp + 0x24]
lea eax, [ebp - 0x460]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0040cccd
add esp, 0x20
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40cd8a
jmp 0x40ce75
and dword [ebp - 0x258], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
leave
ret