joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48be28
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x4675a6
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x4675ab
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x46769a
call fcn.004697a0
test eax, eax
je 0x4675fa
mov edi, dword [ebp + 0x18]
push edi
call fcn.0041233b
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x46768f
cmp esi, ebx
je 0x4675f0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x46769c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x467605
xor edi, edi
jmp 0x46763a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00413f30
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.004517d0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x467680
cmp esi, ebx
je 0x46766a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00451fe0
mov eax, 1
jmp 0x46769c
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00451fe0
cmp esi, ebx
je 0x46769a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468310
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x46848d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46846c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x468366
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.0046fe27
mov esi, eax
add esp, 4
test esi, esi
je 0x46848d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x468484
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x468484
mov edi, dword [esp + 0x20]
test edi, edi
je 0x468484
push ebp
push edi
call fcn.00468310
add esp, 8
test eax, eax
je 0x468479
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4a8ca4]
test eax, eax
je 0x468415
test ebp, ebp
je 0x468415
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x468484
jmp 0x468421
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x468484
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x468463
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x468484
mov eax, dword [esp + 0x14]
jmp 0x4683be
push esi
call fcn.0046fe50
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x468484
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0046fe50
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4731c8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x473200
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004705b2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00470589
jmp 0x47320c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x474fcd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47500f
call fcn.004815e7
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x47500f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x475006
xor eax, eax
jmp 0x475017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047501d
pop edi
pop esi
pop ebx
ret 4
Function at 0x477007
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x477037
push edi
call ebx
push eax
call fcn.0047848f
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x477061
test byte [ebp - 4], 1
je 0x477061
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x477061
push edi
call ebx
push eax
call fcn.0047848f
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x477107
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00476f54
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x477093
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00476f54
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x4770a9
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00476f54
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4770d3
push 0
call ebx
push eax
call fcn.0047848f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4770f1
push eax
call ebx
push eax
call fcn.0047848f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x477105
push eax
call ebx
push eax
call fcn.0047848f
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x47712e
test byte [ebp - 4], 1
jne 0x47712e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x47712e
push edi
call ebx
push eax
call fcn.0047848f
pop edi
pop ebx
leave
ret 8
Function at 0x49e867
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401e9c
mov eax, dword [0x51b500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004063d4
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x49e8a9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x49ea05
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406541
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x51f348]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004034d1
mov ecx, dword [esi*4 + 0x51f348]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x49e9fe
cmp eax, dword [edi + ecx + 0x24]
jne 0x49e9fe
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49e9fe
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004034d1
add esp, 0x14
test edx, edx
jl 0x49e9fe
jg 0x49e974
test eax, eax
jb 0x49e9fe
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x49e9fe
jl 0x49e98e
cmp dword [ebp - 0x1008], eax
ja 0x49e9fe
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x49e9ac
test ebx, ebx
je 0x49e9e5
cmp ecx, edi
jae 0x49e9e5
mov al, byte [ecx]
cmp al, 0xd
jne 0x49e9c6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x49e9d2
cmp byte [ecx + 1], 0xa
jne 0x49e9d2
inc ecx
jmp 0x49e9d2
movzx eax, al
movsx eax, byte [eax + 0x51b828]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x49e9ac
cmp edx, ebx
jne 0x49e9ac
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x49ea03
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403297
leave
ret
Function at 0x49f144
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x51f348]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49f184
cmp byte [ebx], 0xa
jne 0x49f184
or byte [eax + edi + 0x28], 4
jmp 0x49f189
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x49f287
mov al, byte [edx]
cmp al, 0x1a
je 0x49f269
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x49f1b8
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x49f1dd
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49f1e7
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x49f19a
jmp 0x49f287
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49f264
cmp dword [ebp - 0xc], 0
je 0x49f264
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x51f348]
test byte [eax + edi + 0x28], 0x48
je 0x49f23e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x49f229
mov byte [esi], dl
jmp 0x49f23a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x51f348]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x49f287
cmp byte [ebp - 1], 0xa
jne 0x49f24d
cmp esi, ebx
jne 0x49f24d
mov byte [esi], 0xa
jmp 0x49f286
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401a05
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x49f287
mov byte [esi], 0xd
jmp 0x49f286
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x51f348]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49f283
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49f287
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49f2e3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x51f348]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49f326
cmp word [esi], dx
jne 0x49f326
or byte [edi + eax + 0x28], 4
jmp 0x49f32b
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x49f47e
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x49f45e
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x49f36d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x49f3a3
cmp eax, edx
jae 0x49f3af
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x49f345
jmp 0x49f47e
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49f45a
cmp dword [ebp - 0x14], 0
je 0x49f45a
mov eax, dword [ebx*4 + 0x51f348]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x49f432
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x49f3fb
mov word [esi], cx
jmp 0x49f42e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x51f348]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x51f348]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x51f348]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x49f47e
pop ebx
cmp word [ebp - 4], bx
jne 0x49f443
cmp esi, dword [ebp + 0xc]
jne 0x49f443
mov word [esi], bx
jmp 0x49f47b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401a05
add esp, 0x10
cmp word [ebp - 4], bx
je 0x49f47e
push 0xd
jmp 0x49f477
mov ecx, dword [ebx*4 + 0x51f348]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49f475
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49f47e
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a4321
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x51b500]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a436c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a47e3
test al, al
jne 0x4a4366
sub edx, 2
cmp edx, edi
jne 0x4a434c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a438e
lea eax, [edi + 2]
cmp edx, eax
je 0x4a438e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a3f1a
add esp, 0x10
jmp 0x4a4488
push esi
lea ecx, [ebp - 0x255]
call fcn.004a47e3
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a43d1
push dword [ebp - 0x25c]
jmp 0x4a437e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a440e
cmp word [ebp - 0x226], 0
je 0x4a442f
cmp word [ebp - 0x226], ax
jne 0x4a440e
cmp word [ebp - 0x224], 0
je 0x4a442f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a3f1a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a447b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a43e8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a4463
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a4488
push 0x4a3902
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004059cf
add esp, 0x10
jmp 0x4a4458
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403297
leave
ret
Function at 0x403793
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x42b000], 0
push ebx
push ebp
push esi
push edi
mov edi, pe_overlay
mov ebx, 0x42b000
je 0x4037b2
push ebx
call fcn.004058cb
jmp 0x4037b8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
mov esi, dword [0x424364]
test esi, esi
je 0x40380b
mov ecx, dword [0x424328]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x424360]
add ecx, edx
dec esi
mov bp, word [ecx]
xor bp, ax
and ebp, edi
test bp, bp
je 0x4037f0
test esi, esi
jne 0x4037da
jmp 0x40380b
mov edx, dword [ecx + 2]
mov dword [0x423b00], edx
mov edx, dword [ecx + 6]
mov dword [0x4243c8], edx
lea edx, [ecx + 0xa]
mov dword [0x423afc], edx
cmp dword [0x423afc], 0
jne 0x403826
cmp di, 0xffff
jne 0x403822
mov edi, 0x3ff
jmp 0x4037ba
xor edi, edi
jmp 0x4037ba
movzx eax, word [ecx]
push eax
push ebx
call fcn.004058b2
push 0xfffffffffffffffe
push 0x423b20
call fcn.00405960
push eax
push dword [0x420908]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x42434c]
mov esi, dword [0x424348]
test eax, eax
je 0x403873
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x40386a
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00405960
add esi, 0x418
dec edi
jne 0x40385a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4051ed
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422130], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405211
test al, 0x10
jne 0x405214
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422130
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40523f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x401560
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x4015c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4016b6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x401630
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x401605
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x401615
cmp byte [esp + 0x1e], 0
je 0x401615
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401615
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x401950
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x405030
call sym._EnterCriticalSection_4
mov ebx, dword [0x405048]
sub esp, 4
test ebx, ebx
je 0x40199b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401994
test esi, esi
je 0x401994
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401970
mov dword [esp], 0x405030
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5bf4159d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17307415
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219