joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbb6cff
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xbb6d80
call fcn.00bb6d41
push word [esp + 1]
jo 0xbb6d57
jno 0xbb6d57

Function at 0xbb6d41
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 4], esi
call fcn.00bb6d5c
jl 0xbb6d3f
jg 0xbb6d6c
jmp 0xcf8ef9a

Function at 0xbb6d5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ba62f8
jmp 0xbb6d89
mov byte [esp], ch
push di
jmp 0xbb6d67
pop word [esp + 1]
mov dword [esp], esp
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xbb6d9f
mov dh, 0x99
sete bh
stc
jo 0xbb6dbb
xchg ebp, eax
jmp 0xbb6dd3
pushfd
jmp 0xbb4ec0
xchg ebp, eax
jmp 0xbb6dd3
jmp 0xbb6da5
lea ebp, [esp]
xor ecx, edx
jns 0xbb6de0
mov cx, word [esp]
jmp 0xbb6f9a
mov edi, dword [esp + 0x2c]
mov ax, bx
mov ebx, ecx
mov ch, bh
jmp 0xbb6dbd
mov cx, word [esp]
mov dl, bh
setl bl
jmp 0xbb6e36
jmp 0xbb6f27
sub esp, 0xc0
mov esi, esp
inc ecx
jnp 0xbb6e0e
jp 0xbb6f27
mov dl, bh
setl bl
jmp 0xbb6e36

Function at 0xbdda30
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0xbddb94
mov dh, al
call 0xbdda58
mov ecx, dword [esp]
jmp 0xbddab6
xor esi, esi
jmp 0xbddadd
lea esp, [esp + 4]
div ecx
not esi
bt si, ax
jmp 0xbddaa0
mov ebx, eax
rdtsc
lea edx, [eax - 0xcf]
rdtsc
push 3
jmp 0xbdda70
test eax, eax
call 0xbddae5
or ecx, dword [ebp + reloc.MSVCRT.dll_strncpy]
xchg byte [esi - 0x72000364], bh
xor al, 0xb5
add byte [eax], al
add byte [eax], al
jmp 0xbddb27
mov cx, 0x750b
push esi
dec cl
lea esi, [eax + edx]
jmp 0xbddacd
pushal
cpuid
setbe ch
mov dword [esp + 0x1c], ebp
push ecx
jmp 0xbddb36
not si
push si
mov ecx, dword [esp]
lea esp, [esp + 2]
push eax
jmp 0xbddb11
mov word [esp + 1], bp
lea esp, [esp + 4]
popal
lea eax, [eax + 0x10]
mov ecx, dword [eax]
jmp 0xbddb70
lea esi, [edi*4]
bswap esi
jmp 0xbddb7d
mov cx, 0x4ca5
not edx
push ebx
lea ecx, [edi*4]
mov cx, si
jmp 0xbddb05
pop eax
mov si, 0xf39e
push edi
lea edi, [esp + edx]
mov esi, ecx
jmp 0xbddb47
push edx
mov edx, ebp
jmp 0xbddbb6
push ecx
btr edx, edi
rol dx, 1
push ecx
xchg edx, ecx
jmp 0xbddb5d
mov dword [ebp - 4], ecx
call fcn.00bde036
add edi, dword [edx - reloc.MSVCRT.dll_strncpy]
jecxz 0xbddbe3
push ss
add dword [esi + 0x26], esi
mov ebx, 0x8528db7
lea edx, [edx + 8]
mov edi, dword [edx]
pop edx
mov si, 0x4585
mov esi, 0x5ca929b9
jmp 0xbddba0
inc dword [ebx + reloc.MSVCRT.dll_strncpy]
and al, 3

Function at 0xbf8e1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [eax]
inc eax
jmp 0xbf3505
inc eax
test cx, cx
jmp 0xbf8e8c
lea esp, [esp + 4]
push ebx
jmp 0xbf8e36
jmp 0xbf8e08
lea esp, [esp + 4]
je 0xbf33fc
pushal
mov dword [esp + 0x11], edi
jmp 0xbf8e80
call eax
cmc
cmp eax, reloc.MSVCRT.dll_strncpy
push ebx
jmp 0xbf8e20
mov eax, dword [0xbb4d9c]
call dword [eax + 0xc]
bswap edx
mov eax, ebx
jmp 0xbf8ea2
lea esp, [esp + 0x20]
push eax
lea eax, [ecx + ecx]
mov ah, dl
jmp 0xbf8e5d
jne 0xbf34fb
sub esp, 0x1f
call fcn.00bf8eaa
ret 0xda44
lea edx, [eax + 2]
jmp 0xbf34fb
Function at 0xc5c1fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
lea edx, [ebp*4]
bsr ebp, ebp
pop word [esp + 6]
jmp 0xc5c2aa
shl ah, cl
bswap ebp
bsr ebx, eax
and ebp, esi
popal
mov dword [esp + 3], ecx
setnp bh
lea ebp, [edx + ebx]
xchg ebp, eax
clc
cpuid
jmp 0xc5c236
sub esp, 0xa
sub esp, 0x19
pop esi
pop word [esp + 0x11]
xchg dword [esp + 0x10], eax
lea esp, [esp + 1]
jmp 0xc5c24c

Function at 0xc5c461
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax*4]
dec bh
sub esp, 6
mov word [esp + 5], di
jmp 0xc5c570
mov cx, 0x6693
cpuid
mov edi, ebp
mov bp, word [esp + 2]
inc edx
jmp 0xc5c4f6
mov bl, byte [esp + 4]
push word [esp + 1]
xchg edx, esi
mov cl, 0xc4
mov dx, word [esp]
mov dx, bp
jmp 0xc5c48e
pop ecx
lea eax, [edi*4]
pop word [esp + 2]
rdtsc
stc
bsr bx, di
jmp 0xc5c4a4
add bl, ah
mov ebp, edi
push ax
neg dx
mov bl, byte [esp + 4]
rdtsc
jmp 0xc5c52d
mov byte [esp + 5], dl
lea ebp, [edi*4]
lea ebx, [ecx*4]
mov edx, 0x3eab2261
pop word [esp + 2]
mov byte [esp], ah
jmp 0xc5c4e0
add esp, 6
lea edx, [esi + ebp]
mov ah, byte [esp]
not di
xchg byte [esp], bh
jmp 0xc5c556
xchg word [esp], bx
xchg cl, dh
xchg edi, esi
setnp bh
mov bh, al
mov byte [esp + 5], al
jmp 0xc5c517
sub esp, 0
xchg byte [esp], ch
rdtsc
not bh
mov dh, byte [esp]
add esp, 0
call fcn.00c5c587
sti
lea edx, [esp + ebx]
xchg ebx, edx
xchg byte [esp], ah
mov cx, 0x3b0a
mov bl, byte [esp]
xchg ecx, edi
jmp 0xc5c540
xchg word [esp + 2], dx
inc bh
not dl
xchg ecx, ebp
lea esp, [esp + 3]
ror ebx, 0x17
jmp 0xc5c4ca

Function at 0xc5e888
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
push dword [esp + 2]
mov dword [esp + 0x18], ebp
push esp
call fcn.00c5e872
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0x60630f89
sub eax, 0x6022e6fb
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x17cd49bb
sub dword [ebp - 0x30], 0xc97b0470
mov dword [ebp - 0x2c], 0x6e8911ab
sub dword [ebp - 0x2c], 0x3c55c566
mov dword [ebp - 0x28], 0xe9a308fd
sub dword [ebp - 0x28], 0x9d56c4cf
mov dword [ebp - 0x24], 0xb700f574
sub dword [ebp - 0x24], 0xb700f574
lea eax, [ebp - 0x30]
push eax
mov eax, 0x8cc51e05
add eax, 0x737b525f
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x53cea680
add dword [ebp - 0x30], 0x20a3c2d6
mov dword [ebp - 0x2c], 0x1174f534
sub dword [ebp - 0x2c], 0xd00893bf
mov dword [ebp - 0x28], 0x5875fb8a
sub dword [ebp - 0x28], 0xf5068f1e
mov dword [ebp - 0x24], 0xe1274bca
add dword [ebp - 0x24], 0x1ed8b436
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x18a6196f
sub eax, 0x1865a8c7
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37dee
push 0
call eax
mov ecx, 0x58923a50
add ecx, 0xa76e12c9
mov esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x20]
mov edx, 0x46dd9dba
xor dword [ebp - 8], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x18], ebx
sub ebx, edx
mov dword [esi], ebx
add dword [ebp - 0x14], 0xcedeba93
add esi, 0xa06e8af0
add esi, 0x5f917514
add edi, 0xa6fb1f41
sub edi, 0xa6fb1f3d
loop 0x4029a4
add eax, 0x3dbe1d06
add eax, 0xc2430a31
xor ebx, ebx
add ebx, eax
add eax, 0xe780e47b
add eax, 0x187f1b8a
mov ecx, 0x73fe9a45
sub ecx, 0x73be9a45
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401024
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
push edi
xor eax, eax
push 0x18e
mov word [ebp - 0x198], ax
xor edi, edi
lea eax, [ebp - 0x196]
push edi
push eax
call fcn.00423fe0
add esp, 0xc
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x43f31c]
push dword [0x43f314]
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, 0x43f310
call fcn.00406508
push 0x5c
call fcn.004064de
cmp eax, edi
jle 0x40109b
mov ecx, dword [0x43f314]
cmp ecx, edi
je 0x40109b
cmp eax, dword [0x43f318]
jae 0x40109b
xor edx, edx
mov dword [0x43f318], eax
mov word [ecx + eax*2], dx
call fcn.0040aef0
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4010cd
push 0x10
push str.Network_error
push str.WSA_sockets_startup_failed_
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x401100
call fcn.0040ea22
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00406464
call fcn.004062bf
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x406fd9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x406fe7
push 0xd
pop eax
jmp 0x40701a
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406fee
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40743f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 4]
push dword [esi]
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00407401
mov ebx, eax
cmp ebx, edi
je 0x407482
cmp dword [ebp - 0xc], edi
je 0x40747e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4074ef
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4074a0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040743f
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x4074f6
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x100
call ebx
test eax, eax
je 0x40748a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x4074d6
push dword [ebp - 0xc]
call ebx
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
call fcn.00407555
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x4074ed
push dword [ebp - 0xc]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 0xc], edi
je 0x407504
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x4074ef

Function at 0x407555
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x43f28c], 0
jne 0x407585
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x40757e
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x43f290], eax
mov byte [0x43f28c], 1
mov eax, dword [0x43f290]
test eax, eax
je 0x40759d
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x4075a9
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x407d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
xor esi, esi
push 2
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x40c], esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x407da8
call fcn.00406b54
mov esi, eax
jmp 0x407e93
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x407dc5
call fcn.00406b54
jmp 0x407e8a
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp + 8], eax
cmp eax, esi
je 0x407dbb
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x407e08
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407dfe
lea eax, [ebp - 0x40c]
call fcn.00406b2a
mov eax, 0x8007000e
jmp 0x407eae
push 2
pop ecx
mul ecx
cmp edx, esi
ja 0x407e16
cmp eax, 0xffffffff
jbe 0x407e20
push 0x80070057
call fcn.00407333
cmp eax, 0x400
jbe 0x407e36
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00406b33
jmp 0x407e42
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], esi
jne 0x407e51
mov esi, 0x8007000e
jmp 0x407e8c
push edi
push dword [ebp - 0x40c]
push edi
push dword [ebp + 8]
push esi
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, esi
je 0x407dbb
mov edx, dword [ebp - 0x40c]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x40c]
lea ecx, [ebp - 8]
call fcn.00407c40
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407eac
lea eax, [ebp - 0x40c]
call fcn.00406b2a
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4084c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408526
cmp dword [ebp + 0xc], 1
je 0x4084fe
cmp dword [ebp + 0xc], 2
je 0x4084fe
push 0xd
pop eax
jmp 0x408526
mov eax, dword [ebp - 4]
test edi, edi
je 0x408520
test eax, eax
je 0x40851b
test al, 1
jne 0x4084f9
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x408520
jmp 0x4084f9
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x408ce2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x408d2c
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x408d53
shr eax, 2
test al, 1
je 0x408d5c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x408d8f
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x435944
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x408d8e
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret

Function at 0x40af60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b8
push ebx
push esi
lea eax, [ebp - 0x9b8]
call fcn.00406522
lea eax, [ebp - 0x218]
call fcn.00406522
lea eax, [ebp - 0x7a0]
call fcn.00409daa
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x464]
push ebx
push eax
mov dword [ebp - 0x468], ebx
call fcn.00423fe0
add esp, 0xc
push str.English
lea esi, [ebp - 0x218]
call fcn.0040add8
mov eax, esi
lea ecx, [ebp - 0x7a0]
call fcn.00409f2d
test al, al
jne 0x40afdb
lea eax, [ebp - 0x7a0]
call fcn.00409def
pop esi
mov al, bl
pop ebx
leave
ret
lea eax, [ebp - 0x7a0]
push eax
call fcn.0040b53a
push 0x4323c8
push dword [0x43f314]
lea eax, [ebp - 0x9b8]
push str._slanguages_s_.lng
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x9b4]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b079
lea eax, [ebp - 0x43c]
push eax
push dword [0x43f314]
lea eax, [ebp - 0x218]
push str._slanguages_s
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x7a0]
call fcn.00409f2d
test al, al
je 0x40b060
lea eax, [ebp - 0x7a0]
push eax
call fcn.0040b53a
lea eax, [ebp - 0x468]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40b01f
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
jmp 0x40afca
Function at 0x40b080
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbd0
push ebx
push esi
lea eax, [ebp - 0x430]
call fcn.00406522
lea eax, [ebp - 0x898]
call fcn.00406522
lea eax, [ebp - 0x218]
call fcn.00406522
lea eax, [ebp - 0xbd0]
call fcn.00409daa
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x67c]
push ebx
push eax
mov dword [ebp - 0x680], ebx
call fcn.00423fe0
add esp, 0xc
push dword [ebp - 0x214]
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x40b0fb
lea eax, [ebp - 0xbd0]
call fcn.00409def
pop esi
mov al, bl
pop ebx
leave
ret
lea esi, [ebp - 0x218]
call fcn.00406508
mov esi, 0x4323c8
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push str._s_s_
call fcn.004017c3
add esp, 0xc
push dword [ebp - 0x42c]
push 0x40b1e3
push 0xa
push ebx
call dword [sym.imp.KERNEL32.DLL_EnumResourceNamesW]
push 0x435aa8
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push str._s_s_._s
call fcn.004017c3
add esp, 0x10
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b1dc
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x898]
push str._s_s
call fcn.004017c3
add esp, 0xc
lea eax, [ebp - 0x898]
lea ecx, [ebp - 0xbd0]
call fcn.00409f2d
test al, al
je 0x40b1b3
lea eax, [ebp - 0xbd0]
push eax
call fcn.0040b53a
push dword [ebp - 0x894]
push 0x43f550
call fcn.0040b970
lea eax, [ebp - 0x680]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40b172
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
jmp 0x40b0ea

Function at 0x40b440
Capabilities:
Delete file

Disassembly:
push esi
xor esi, esi
cmp dword [0x43f558], esi
jbe 0x40b469
mov eax, dword [0x43f560]
imul eax, esi
add eax, dword [0x43f554]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
inc esi
cmp esi, dword [0x43f558]
jb 0x40b44b
and dword [0x43f558], 0
pop esi
ret
Function at 0x40baaa
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40bb12
cmp dword [ebp + 0xc], esi
je 0x40bb12
cmp dword [ebp + 0x10], esi
je 0x40bb12
cmp dword [ebp + 0x14], esi
je 0x40bb12
mov eax, dword [edi]
cmp eax, esi
je 0x40bb12
cmp dword [eax + 0xc], esi
je 0x40bb12
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40bb12
lea eax, [ebp - 8]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x40bb19
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40bb3c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x40bb08
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40bb64
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x40bb08
push esi
push esi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x40bb53
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x40bb14
Function at 0x40c301
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
push ebx
push esi
push edi
xor eax, eax
push 0x40e
mov word [ebp - 0x874], ax
xor esi, esi
lea eax, [ebp - 0x872]
push esi
push eax
call fcn.00423fe0
add esp, 0xc
cmp dword [ebp + 0xc], esi
je 0x40c495
cmp dword [ebp + 0x10], esi
je 0x40c495
cmp dword [ebp + 0x14], esi
je 0x40c495
cmp dword [ebp + 0x18], esi
je 0x40c495
lea eax, [ebp - 0x874]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40c495
lea ebx, [ebp - 0x874]
call fcn.0040cb90
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c495
push 0x24c
lea eax, [ebp - 0x258]
push esi
push eax
mov dword [ebp - 0x25c], esi
call fcn.00423fe0
mov eax, ebx
push eax
mov ebx, 0x103
push 0x435d30
mov ecx, ebx
lea edi, [ebp - 0x464]
call fcn.0040cb04
add esp, 0x14
lea eax, [ebp - 0x25c]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40c495
test byte [ebp - 0x25c], 2
jne 0x40c3f5
test byte [ebp - 0x25c], 0x10
je 0x40c3f5
cmp word [ebp - 0x230], 0x2e
jne 0x40c40b
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40c3d9
jmp 0x40c488
push dword [ebp + 0x10]
lea eax, [ebp - 0x230]
push dword [ebp + 0xc]
mov esi, str._s_s_s_s.sol
push eax
lea eax, [ebp - 0x874]
push eax
push esi
mov ecx, ebx
lea edi, [ebp - 0x464]
call fcn.0040cb04
mov eax, edi
push 0x5c
push eax
call fcn.004220d3
add esp, 0x1c
test eax, eax
je 0x40c448
xor ecx, ecx
mov word [eax], cx
lea ebx, [ebp - 0x464]
call fcn.0040ca64
push dword [ebp + 0x10]
lea eax, [ebp - 0x230]
push dword [ebp + 0xc]
mov ecx, 0x103
push eax
lea eax, [ebp - 0x874]
push eax
push esi
mov edi, ebx
call fcn.0040cb04
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push eax
call fcn.0040c49e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
jmp 0x40c497
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x14