joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e82ed
Capabilities:
Encode data using xor

Disassembly:
sub byte [edi - 0x28], dh
test al, 0x35
sub byte [eax + ecx*8 + 0x5fb8f29a], dl
invalid
cmp dword [eax], ebp
insd dword es:[edi], dx
pop eax
cld
inc esp
imul edx, dword [esi + ebp], 0x798449f4
mov bl, dl
jns 0x5e82b3
test dword [ebx - 0x76], ebp
push es
iretd
or bl, cl
or ch, dl
cmp al, 0xa6
or byte [esi + ebx*4 + 0x3bdb06bb], al
cld
jnp 0x5e81e8
xor dl, byte [ecx]
inc ecx
or ecx, esi
pop edx
xchg ebx, eax
jns 0x5e82ce
sbb dword [ebx + 0x57], ebx
int3
adc byte [edi], al
jl 0x5e82a1
movsd dword es:[edi], dword [esi]
cmp dl, byte [ebp + 0x68]
mov dword [eax - 0x1513f23a], esi
xor dword [ebp - 0x6d8ce1c7], ebp
lodsd eax, dword [esi]
cmp dword [esi], ebx
jae 0x5e8238
xchg ebp, eax
js 0x5e82ea
call 0x4923a8fa
sub eax, 0xd3e369d3
mov ebx, 0xc09345f7
inc ecx
fcomp st(5)
adc al, 0x6b
fdiv st(2)
xor byte [ebx + ebp*2 - 0x54], 0x47
jns 0x5e824f
mov ch, byte [eax - 0x42f99629]
xchg byte [eax + 0xa588298], al
sub ebx, dword [ecx + 0x143d4543]
ljmp 0xef55
cwde
sbb byte [eax + 0xa], 0x2b
cdq
inc ebx
inc ebp
cmp eax, 0xc3feea14
mov ah, 0x6d
push ebp
out dx, eax
xor al, 0x81
test al, 0xbf
movsb byte es:[edi], byte [esi]
pop ecx
test al, 0x73
mov dword [edi], ebx
cli
popfd
enter 0x3e31, 0x3d
cmp eax, 0x8166f9fc
sti
dec eax
shl byte [ecx], cl
loopne 0x5e8292
cmp eax, 0x8166f9fc
sti
dec eax
shl byte [ecx], cl
loopne 0x5e8292
inc esi
xor byte [edx + edi*8 + 0x168fe976], 0x8d
insd dword es:[edi], dx
pop es
xor ebx, eax
jns 0x5e831d
movsd dword es:[edi], dword [esi]
retf 0xbf29
cdq
dec edx
adc eax, 0x89b7f8e2
sbb byte [ebp - 0x47df9828], bh
inc ebp
sbb ebp, ecx
cdq
pop ecx
popfd
test dword [ebx + 0x6fc5c608], edi
sbb byte [eax + 0x267ee699], bl
cmp edi, dword [edx + 0x59611972]
cwde
sub bl, byte [eax]
jns 0x5e83a6
sbb dword [ebp - 0x36], edi
fild dword [eax + 0x1af823f3]
fxch st(1)
inc edi
fdivr dword [ebx + ecx*8 + 0x55]
sbb byte [eax + edi*4 - 0x56574686], ch
inc ebx
fstp qword [eax - 0xca2c4d5]
sbb eax, 0x3daa48c8
lahf
dec eax
in al, dx
sub byte [eax + 0x631938bb], al
int3
dec ecx
cmp al, byte [edi + 0x59845ff1]
mov byte [edx], bh
adc byte [edx - 0xc], bh
and ecx, dword [ebx]
push 0x6b0c7168
xor eax, 0x2b8ccf1
pop edi
cwde
add eax, 0xe9a4b6a0
jg 0x5e83b1
hlt
int1
int3
mov ecx, 0xde2c1166
adc ch, al
push ecx
clc
dec esp
movsb byte es:[edi], byte [esi]
leave
insb byte es:[edi], dx
int 0x91
je 0x5e836b
clc
or dword [ecx], 0x69
or dword [ecx + 0x77], ebp
invalid
and ebx, dword [edi + 0x3e]
jbe 0x5e842e
Function at 0x639fbd
Capabilities:
Encode data using xor

Disassembly:
in al, 0x72
add bh, byte [ebx + 0x60]
jb 0x639f23
jnp 0x639f83
xor ch, dl
pop ebp
sar byte fs:[0xfdfcad4], cl
mov esi, 0xc96e8cf0
xor dword [edi - 0x35cd349e], ebx
int 0xae
jne 0x639f1e
push edi
adc cl, byte [esi + 0x10]
loopne 0x639f97
dec edi
mov dl, 0x91
or eax, 0x10e2ee98
outsb dx, byte [esi]
dec ecx
insd dword es:[edi], dx
push cs
cmp eax, 0x9ef8ebe8
adc ebp, edx
movsb byte es:[edi], byte [esi]
jb 0x639f42
mov dh, 0x32
or al, 0xe8
xor cl, byte [eax + ebp*8]
jo 0x639f1f
fidiv word [esi - 0x12]
stc
into
cmp ah, byte [0x3ea9209b]
mov esp, 0xdcc7507c
mov esp, 0xdcc7507c
jl 0x639fbe
invalid
std
pop eax
pushfd
dec ecx
push eax
mov al, byte [0xb385a4ac]
mov dl, 0x92
inc ebx
mov al, byte [0x23ffb5bb]
mov al, dl
jo 0x639f5b
sbb dword [edx + 0x1c], edx
int3
ror byte [esi], 8
call 0xfb95096d
sti
xchg esi, eax
cmc
xor al, 0xc7
adc al, 0xb8
jb 0x63a017
jo 0x639f6c
les eax, [ecx]
jne 0x639f47
add dword [ebp - 0x64], esi
pop ecx
adc dh, bh
pushfd
aam 0xa5
mov dword [ebp + 0x62a9604e], eax
daa
scasb al, byte es:[edi]
dec ebp
loop 0x63a00f
jae 0x639f6a
lodsb al, byte [esi]
mov ch, byte [esi + edi - 0x5a]
cmpsb byte ds:[esi], byte es:[edi]
jne 0x639fc0
pop ds
push ds
rcr byte [eax + 0x28], 1
jge 0x639fa6
inc ebp
test al, 0x42
jo 0x63a012
test byte [edi - 0x3a], dl
jge 0x639fa7
mov cl, byte [0x2505b040]
invalid
add eax, 0x67e48d25
xchg edi, eax
je 0x63a04c
sbb eax, 0xecf92a1e
mov edi, dword [esi]
inc ecx
sbb dh, ah
pop ebp
mov dh, 0xac
lodsb al, byte [esi]
das
loopne 0x639f9e
sub al, byte [eax - 0x5e]
and al, 0xd2
scasd eax, dword es:[edi]
sbb al, 0x4a
jecxz 0x639fd9
cmp dword [edi - 0x21891475], 0x71
jge 0x63a05d
fidiv word [ecx + 0x7d]
cmp byte [eax + 0x5a], dl
push eax
pop edx
loope fcn.00639fed
std
aaa
or al, 0x80
dec ebp
loop fcn.00639fbd
inc eax
xor al, 0x1d
cmp dword [esi + 0x2de47c10], esp
mov eax, dword [0x66bdb7f0]
les ecx, cs:[ebx + 0x5a]
xchg ecx, eax
scasb al, byte es:[edi]
cmp eax, 0x7dc19a4a
hlt
invalid
pop ss
push 0x14d483d1
sub dword [edi - 0x2f], eax
push ebp
pop ds
retf 0x6d44
inc eax
call dword [eax]
adc dh, byte [edi + edi - 0x1f883edb]
fsub qword [edx - 8]
xchg ecx, eax
in al, 0x3f
movsd dword es:[edi], dword [esi]
jne 0x63a021
sub byte [edi], 0x11
in eax, dx
mov al, byte [0xcd6dde71]
push esp
or dword [edx + edx*2 - 0x1b], esp
jl 0x63a03b
cmp al, ch
pop ebx
invalid
Function at 0x64287d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
inc ebp
sub esp, dword [esi + 0x4e]
sub byte [esi + 6], 0xb2
cmp eax, 0xaed154a3
jg 0x642855
out dx, eax
pop es
das
push 0x1e
mov eax, dword [0x23bd4ad1]
enter 0x5526, 0x69
sbb byte [ebp - 0x31066546], cl
mov edx, 0x52c804f9
out 0xdd, eax
cmpsd dword [esi], dword es:[edi]
add byte [esi + 0x43], 0x22
sbb al, 0xad
fidiv word [ebx]
mov ebx, 0x4f200b43
mov al, byte [0x20b1494e]
fcmovu st(0), st(6)
mov dl, 0xc9
pop edi
ficom word [ebp + 0x5cc0a353]
pop esp
rcl eax, 0xe9
dec esp
inc eax
sub bh, byte [ecx - 0x211810b]
mov ecx, 0xfdee7ef5
aas
fucompp
push ebx
cmp bh, byte [edx + 0x2f3a9f5e]
dec ebx
push 0x6a
aaa
add dl, 0xf2
leave
stc
inc esi
mov edx, 0x2fd04562
lcall 0xe006, 0x704c80c9
dec esp
jo 0x642886
loopne 0x64287e
dec esp
jo 0x642886
loopne 0x64287e
loopne 0x64280e
inc edx
fdivr dword [esi]
sub edx, dword [ebx]
sub edx, dword ds:[ebx]
push esp
push eax
cmpsb byte [esi], byte es:[edi]
in eax, dx
mov word [eax + 0x5c], fs
lcall 0x7a90, 0x7efb6b58
xor ebx, edx
or byte [edx + ebp*8], ch
fcom qword [edx + ecx*8]
inc edx
pop esp
je 0x64285c
sbb cl, ch
outsd dx, dword [esi]
pop esp
sal byte [esi + 0x21], 0x12
sal byte [ebp + 0x1c], 0x85
nop
add al, 0xb5
mov dl, 0xd5
pushal
pop esp
push eax
pushal
xchg byte [eax + 0x710ed7fb], ch
insd dword es:[edi], dx
jne 0x642901
inc ebx
dec edx
invalid
hlt
Function at 0x10044507
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100445a4
push ebx
push esi
call fcn.100444d0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10044419
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10044551
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100445a3
push edi
push eax
call fcn.100454be
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10044571
call fcn.10043029
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100445a2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10044419
add esp, 0x20
test eax, eax
jne 0x10044590
push edi
call fcn.10043029
jmp 0x10044598
push ebx
call fcn.10043029
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1004480f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004c540
push 0x1004c538
push str.FlsAlloc
push 0x1e
call fcn.1004472d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10044843
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004b140]
call esi
jmp 0x10044849
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004488d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004c550
push 0x1004c548
push str.FlsGetValue
push 0x20
call fcn.1004472d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100448c4
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004b140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10049f70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10049f9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10049f9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402cc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402cd8
pop dword [ebp - 0x48]
mov eax, 0x402cd8
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x991df92d
add dword [ebp - 0x58], 0xb5344c1e
mov dword [ebp - 0x54], 0xcb95ac11
add dword [ebp - 0x54], 0x669da034
mov dword [ebp - 0x50], 0x9a61c1cb
sub dword [ebp - 0x50], 0x4e157d9d
mov dword [ebp - 0x4c], 0x9dbc91b7
sub dword [ebp - 0x4c], 0x9dbc91b7
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3d23462
add dword [ebp - 0x58], 0x70a034f4
mov dword [ebp - 0x54], 0x8de28228
sub dword [ebp - 0x54], 0x4c7620b3
mov dword [ebp - 0x50], 0xa953930a
sub dword [ebp - 0x50], 0x45e4269e
mov dword [ebp - 0x4c], 0x1eeb190e
sub dword [ebp - 0x4c], 0x1eeb190e
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x68029b52
sub eax, 0x67c22b3a
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x366a8
push 0
call eax
mov ecx, 0x4374
xor ebx, ebx
add ebx, eax
mov edx, 0x40c800
add edx, dword [ebp - 0x48]
mov edi, 0xc69ed061
add edi, 0x4d10e9e7
xor dword [ebp - 0x3c], edx
mov esi, dword [edx]
sub esi, edi
sub dword [ebp - 0x2c], 0x306403a1
mov dword [ebx], esi
sub dword [ebp - 0x24], eax
add ebx, 0x7d2d931c
sub ebx, 0x7d2d9318
add edx, 0x7104a27d
add edx, 0x8efb5d87
loop 0x402de6
add eax, 0x100a3
mov ebx, eax
add eax, 5
mov ecx, 0x4bcff30a
add ecx, 0xb4700cf6
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x404dec
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x40668a
call fcn.004058c6
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x40a1cc], ebx
jne 0x404e0c
mov al, 1
jmp 0x404ede
cmp esi, ebx
je 0x404edc
cmp word [esi], bx
je 0x404edc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404edc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404edc
lea eax, [ebp - 0x2c]
push esi
push eax
mov byte [ebp - 0x2d], bl
call main
pop ecx
pop ecx
mov esi, dword [0x40a1cc]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
je 0x404ec8
lea eax, [ebp - 0x2c]
push eax
call main
pop ecx
test al, al
jne 0x404ec8
cmp dword [ebp - 0x1c], esi
jbe 0x404ec8
cmp dword [0x40a1d0], 8
mov ecx, dword [0x40a1bc]
jae 0x404e7f
mov ecx, 0x40a1bc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x404e8b
lea eax, [ebp - 0x2c]
push esi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404ec8
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x404ea7
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x404ec8
push str..lnk
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x404ec8
mov byte [ebp - 0x2d], 1
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call main
mov al, byte [ebp - 0x2d]
jmp 0x404ede
xor al, al
call fcn.00405910
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401443
pop dword [ebp - 0x18]
mov eax, 0x516a86f1
sub eax, 0x512a72ae
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x2d9277b
sub dword [ebp - 0x28], 0xb486e230
mov dword [ebp - 0x24], 0x8ce8322d
sub dword [ebp - 0x24], 0x5ab4e5e8
mov dword [ebp - 0x20], 0xe541e15f
sub dword [ebp - 0x20], 0x98f59d31
mov dword [ebp - 0x1c], 0x32a8021c
sub dword [ebp - 0x1c], 0x32a8021c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1a9d0f9b
sub eax, 0x1a5c8e97
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x86d90710
sub dword [ebp - 0x28], 0x12669dba
mov dword [ebp - 0x24], 0xbeec77a7
sub dword [ebp - 0x24], 0x7d801632
mov dword [ebp - 0x20], 0xeddbd66d
add dword [ebp - 0x20], 0x759395ff
mov dword [ebp - 0x1c], 0xb0c7e4d7
sub dword [ebp - 0x1c], 0xb0c7e4d7
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa3aa4f7d
sub eax, 0xa369ce7d
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x34faa
push 0
call eax
mov ecx, 0x5de62177
add ecx, 0xa21a1959
mov edi, eax
mov ebx, 0x450400
add ebx, dword [ebp - 0x18]
mov esi, 0x2f699356
xor dword [ebp - 0xc], ecx
mov edx, dword [ebx]
sub edx, esi
add dword [ebp - 0x10], 0x24b760d8
mov dword [edi], edx
sub dword [ebp - 8], edx
add edi, 4
add ebx, 4
loop 0x401559
add eax, 0x6b7bf9f5
add eax, 0x9484e41e
mov ebx, eax
add eax, 5
mov ecx, 0x3180b637
sub ecx, 0x3140b637
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f90]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004064be
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x434f90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x434f90], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x401380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4013db
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4013db
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4013c8
cmp esi, edx
jae 0x4013db
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4013b6
cmp esi, edx
jae 0x4013db
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x401770
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4317de
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x43e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 1
call fcn.00401550
mov ecx, eax
test ecx, ecx
je 0x401856
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0
push 0
push 3
push 0
push 5
push 0x80000000
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401838
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x40184c
mov ecx, dword [edi]
mov edx, 1
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, esi
or ecx, edx
jge 0x401817
push esi
mov ecx, edi
call fcn.0040a580
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x40184c
mov dword [ecx - 0xc], esi
mov eax, dword [edi]
push 0
mov byte [esi + eax], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401290
push 0x80004005
call fcn.00401290
int3

Function at 0x401870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
mov edi, ecx
mov ebx, edx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4018cd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4018ac
call esi
mov esi, eax
jmp 0x4018b7
call esi
movzx esi, ax
or esi, 0x80070000
push esi
push edi
push 0x439fa0
call fcn.004010c0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4018f0
Capabilities:
Access pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0
push 3
push 0
push 5
push 0x80000000
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x40193b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40192b
call esi
pop edi
pop esi
pop ebp
ret 4
call esi
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
pop ebp
ret 4
push ebx
xor esi, esi
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x401994
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x401975
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx esi, ax
or esi, 0x80070000
call edi
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
test eax, eax
jne 0x4019c8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4019bb
call esi
mov esi, eax
jmp 0x4019e5
call esi
movzx esi, ax
or esi, 0x80070000
jmp 0x4019e5
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [edi + 4], eax
test eax, eax
jne 0x4019e5
push dword [edi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi], esi
mov esi, 0x8007000b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
push dword [ebp + 8]
call edi
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x404280
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431afd
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x43e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0xc]
test esi, esi
jne 0x4042d2
mov esi, 0x80070057
jmp 0x404437
lea ecx, [esi - 1]
test ecx, ecx
js 0x404471
cmp ecx, esi
jg 0x404471
cmp word [eax + ecx*2], 0x5c
je 0x40432d
mov ecx, dword [eax - 8]
lea edi, [esi + 1]
mov edx, 1
sub ecx, edi
sub edx, dword [eax - 4]
or ecx, edx
jge 0x40430c
push edi
lea ecx, [ebp + 8]
call fcn.0040a0e0
mov eax, dword [ebp + 8]
mov ecx, 0x5c
mov word [eax + esi*2], cx
mov eax, dword [ebp + 8]
cmp edi, dword [eax - 8]
jg 0x404471
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebp + 8]
mov word [eax + edi*2], cx
push 0x43a780
lea edx, [ebp + 8]
lea ecx, [ebp - 0x264]
call fcn.00408d90
add esp, 4
lea ecx, [ebp - 0x260]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, dword [ebp - 0x264]
mov edi, eax
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x404371
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xffffffff
jne 0x40439b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40438b
call esi
mov esi, eax
jmp 0x404434
call esi
movzx esi, ax
or esi, 0x80070000
jmp 0x404434
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x260], 0x10
jne 0x404416
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
test esi, esi
je 0x404416
push 0x43a784
push esi
call fcn.00420224
add esp, 8
test eax, eax
je 0x4043f3
push str..DRV
push esi
call fcn.00420224
add esp, 8
test eax, eax
je 0x4043f3
push str..cpl
push esi
call fcn.00420224
add esp, 8
test eax, eax
jne 0x404416
push ecx
lea eax, [ebp - 0x234]
mov ecx, esp
push eax
lea edx, [ebp + 8]
call fcn.00408d90
mov ecx, dword [ebp - 0x268]
add esp, 4
call fcn.00403f60
add esp, 4
lea eax, [ebp - 0x260]
push eax
push edi
call ebx
test eax, eax
jne 0x4043a1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
or ebx, 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x404453
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d660
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401290
int3