joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003be15
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006399b
call fcn.10062184
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x20], 0x73f9
cmp dword [ebp - 0x20], 0x745c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x1003beab
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x24], 0
mov ecx, ebx
mov ebx, esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x24]
sar ebx, cl
xor eax, eax
mov dword [ebp - 0x14], eax
add eax, esi
mov ecx, 0x1007f278
and eax, ebx
cdq
push edx
push eax
call fcn.1000b2a8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x3e79
jl 0x1003be5a
inc esi
cmp esi, 0x749c
jl 0x1003be55
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x16a2
jl 0x1003be45
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x57dc
jl 0x1003be40
push 0x13f9
call dword [sym.imp.KERNEL32.dll_SetLastError]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x714d
jge 0x1003bec7
mov edx, str.tqowsgziq_wmcgb_yfml_vmw_mdkiehgtv_xaq_lxjdg_ylqzp_qemncz_nlbsrl_ycrqjtr_luhill
mov ecx, 0x1007f278
call fcn.1000ee32
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], 0
je 0x1003bf28
mov eax, dword [ebp + 0x1c]
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x1003bf01
mov eax, dword [ebp + 0x14]
movzx edx, word [eax]
add edx, ecx
jmp 0x1003bf0e
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp - 0x28]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x24]
push edx
call fcn.1000b445
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x1003bf17
push 0
mov edx, 0xd32
mov ecx, 0x3228
call fcn.1003cded
mov dword [ebp - 0x18], 0x6b03
cmp dword [ebp - 0x18], 0x6bd7
pop ecx
jle 0x1003bfa0
push 0
push 0x1786
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x20], 0x1f2b
xor esi, esi
mov eax, ebx
mov ecx, 0x1007f278
xor eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0x79d4
jl 0x1003bf71
dec ebx
dec dword [ebp - 0x20]
jne 0x1003bf6f
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2d29
jl 0x1003bf66
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x6963
jge 0x1003bf17
mov edx, str.mdhrbrxpl_vxfdfed_ahgjnaz_oekxqme
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x1003bf17
Function at 0x1003c148
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x100639a5
call fcn.10062184
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0xe72
mov al, dl
cmp dword [ebp - 0x18], 0xf2e
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], al
mov dword [ebp - 0x1c], ecx
jle 0x1003c1b9
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007f278
and eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc ebx
cmp ebx, 0x3239
jl 0x1003c179
inc edi
cmp edi, 0x203d
jl 0x1003c177
inc esi
cmp esi, 0x5440
jl 0x1003c175
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x1c]
push dword [ebp + 8]
mov dl, al
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1003c212
and dword [ebp - 4], 0
add esp, 0xc
cmp dword [ebp - 0x18], 0xad3
jge 0x1003c1e7
mov edx, str.wklcllx_rfrhgjl_bmqtx_kuqvq_iobnfp_ymdhbqju_qang
mov ecx, 0x1007f278
call fcn.1000ee32
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003ccbb
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100639f0
call fcn.10062184
sub esp, 0xc
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x18], 0x6b83
cmp dword [ebp - 0x18], 0x6c03
push edi
mov dword [ebp - 0x10], esp
jle 0x1003cd23
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1007f278
cdq
push edx
push eax
call fcn.1000b2a8
inc edi
cmp edi, 0x2149
jl 0x1003cce7
inc esi
cmp esi, 0x4d5a
jl 0x1003cce5
push 0
push 0x180d
push 0x160a
push 0xa33
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp byte [ebp - 0x14], 0
je 0x1003cd48
call fcn.1003ad62
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, ebx
add dx, word [eax]
movzx eax, dx
push eax
call fcn.1000b445
jmp 0x1003cd58
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003cd58
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x689a
jge 0x1003cd74
mov edx, str.vihzwo_cbxnczxfz_jdoocaf_eypghe_kfzyxgez_fxcggmnjy_kzgdrui_wqrrkbugs_frgqcdmrp_rlzuesw_bbsvxhp
mov ecx, 0x1007f278
call fcn.1000ee32
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d0a3
Capabilities:
Delete directory

Disassembly:
mov eax, 0x10063a2a
call fcn.10062184
sub esp, 0x38
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x1003d0cb
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push dword [eax]
call fcn.1000b487
jmp 0x1003d1eb
push 4
pop esi
push esi
lea ecx, [ebp - 0x24]
call fcn.10001647
mov dword [ebp - 4], 2
xor edx, edx
mov dword [ebp - 0x14], 0x34aafbeb
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], edx
jmp 0x1003d0fc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003d0ef
mov dword [ebp - 0x14], edx
jmp 0x1003d114
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0x32fe2236
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003d106
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], edx
jl 0x1003d1e3
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ebx
push 2
lea ecx, [ebp - 0x30]
call fcn.10001647
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1003d150
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], 0xd95da228
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003d140
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x1003d165
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xf6b34c26
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x30]
mov dword [eax], ecx
sbb eax, eax
mov ecx, dword [ebp - 0x24]
inc eax
xor edx, edx
cmp eax, dword [ebx + 0xc]
setg dl
imul edx, dword [ecx + esi*4]
imul eax, edx, 0xd162
xor edx, edx
cmp eax, dword [ecx + edi*4]
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
cmp dword [eax], ebx
mov eax, dword [ebp - 0x24]
setne bl
xor edx, edx
cmp ebx, dword [eax + ecx*4]
lea ecx, [ebp - 0x30]
setne dl
mov dword [ebp - 0x14], edx
call fcn.100016a4
dec dword [ebp - 0x38]
mov ebx, dword [ebp - 0x18]
jns 0x1003d12f
lea ecx, [ebp - 0x24]
call fcn.100016a4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d1fc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov dword [ebp - 0x10], 0x357e
mov ebx, ecx
cmp dword [ebp - 0x10], 0x3773
push esi
push edi
mov dword [ebp - 0x18], ebx
jle 0x1003d2a2
xor esi, esi
mov dword [ebp - 0xc], esi
xor edi, edi
mov dword [ebp - 8], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
mov dword [ebp - 0x14], edi
mov eax, edi
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x30]
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001351
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d259
mov eax, dword [eax]
push eax
call fcn.10049280
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.100017dc
inc esi
cmp esi, 0x212d
jl 0x1003d23d
mov edi, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x23c2
jl 0x1003d234
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x658a
jl 0x1003d228
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x6c1a
jl 0x1003d223
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x10], 0x3438
jge 0x1003d2b6
push str.iajzmbd_ngldejvsi_tkevjjdm_valqeeew_xnhwkjc_yrbrg
call fcn.10049280
pop ecx
cmp byte [ebp + 0x18], 0
je 0x1003d2e5
push 0x1a
pop ecx
cmp dword [ebx], ecx
jge 0x1003d2cd
mov eax, dword [ebp + 0x10]
movsx edx, byte [eax]
add edx, dword [ebx]
jmp 0x1003d2da
mov eax, dword [ebx]
cdq
idiv ecx
mov eax, dword [ebp + 0x14]
movsx eax, byte [eax]
add edx, eax
mov ecx, dword [ebp + 0xc]
push edx
call fcn.1003a1a9
jmp 0x1003d2f4
push 0x1436
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003d341
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003d358
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x1003d37a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100805f4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10080980
jl 0x1003d388
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10080c24
jl 0x1003d3c8
mov ecx, dword [0x10081970]
xor ecx, dword [0x100805f4]
and ecx, edi
xor ecx, dword [0x10081970]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100805f0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10080c24]
mov dword [0x10080fb0], eax
pop esi
ret
Function at 0x1003ea60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test dl, dl
je 0x1003ea79
push 0x4a8
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1003ea81
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x100401bd
Capabilities:
Delete file

Disassembly:
mov eax, 0x10063c3d
call fcn.10062184
sub esp, 0x24
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100401eb
and dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x10b1
xor esi, esi
cmp dword [ebp - 0x18], 0x115b
jle 0x1004023c
push esi
push esi
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
lea eax, [ebx + edi]
mov ecx, 0x1007f278
and eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0x340a
jl 0x1004020c
inc ebx
push 0
pop esi
cmp ebx, 0x1e04
jl 0x10040209
inc edi
cmp edi, 0x3e6
jl 0x10040207
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0xed5
jge 0x10040257
mov edx, str.aezuidnr_zcci_iaxj_mxbf_frgtd_elg_izwo_vpaoe
mov ecx, 0x1007f278
call fcn.1000ee32
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [edi], esi
mov eax, dword [ebp + 0x10]
mov edx, dword [edi]
cmp edx, dword [eax]
mov eax, dword [ebp + 0x1c]
jge 0x100401da
cmp dword [ebx], esi
jne 0x100401da
mov eax, dword [eax]
mov ecx, dword [ecx]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jle 0x10040338
mov dword [ebp - 0x1c], 0x1afa
cmp dword [ebp - 0x1c], 0x1c3a
jle 0x100402fe
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push esi
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov eax, esi
mov dword [ebp - 0x18], esi
mov edi, eax
mov ebx, 0xece
mov eax, edi
mov ecx, 0x1007f278
cdq
push edx
push eax
call fcn.1000b2a8
dec edi
dec ebx
jne 0x100402d0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x31fe
jl 0x100402c9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
push ebx
push ecx
push 0x2e6c
push ecx
xor dl, dl
mov ecx, 0x275
call fcn.1003fc97
add esp, 0x10
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x184c
jge 0x10040334
mov edx, str.zpcooz_gtfl_ylyefp_dnvmpff_swktr_codtd_sezwldf_eoagpaj_xsdwjugux_uak_dlxxslk_hmmckhivs_ysjr
mov ecx, 0x1007f278
call fcn.1000ee32
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
push ecx
push esi
push 0x551b
push eax
push ebx
mov edx, 0xc55
mov ecx, edi
call fcn.10040e98
mov ecx, dword [ebp + 0x18]
add esp, 0x14
inc dword [edi]
jmp 0x1004027b
Function at 0x10040bdc
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov byte [esp + 8], cl
mov eax, edx
mov dword [esp + 0x14], 0x1640
cmp dword [esp + 0x14], 0x178b
push esi
push edi
mov dword [esp + 0x24], eax
jle 0x10040c73
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x20], esi
xor ebx, ebx
shl esi, cl
mov eax, esi
lea ecx, [esp + 0x28]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001351
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10040c38
mov eax, dword [eax]
push eax
call fcn.10049280
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100017dc
inc ebx
cmp ebx, 0x106d
jl 0x10040c1e
mov esi, dword [esp + 0x18]
inc edi
cmp edi, 0x76c6
jl 0x10040c14
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x6112
jl 0x10040c12
mov eax, dword [esp + 0x24]
cmp byte [ebp + 0x14], 0
je 0x10040ca0
cmp byte [esp + 0x10], 0
je 0x10040c85
mov byte [eax], 1
jmp 0x10040cc0
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x10040cc0
sub esp, 0xc
mov dl, 1
call fcn.1003ea60
add esp, 0xc
jmp 0x10040cc0
cmp byte [ebp + 0x10], 0
je 0x10040cb8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 8]
sar ecx, 2
mov dword [eax], ecx
jmp 0x10040cc0
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [esp + 0x1c], 0x1623
jge 0x10040cd5
push str.nvdq_lngstmx_adcprhf_spbin_ptiwpgni_ohdupvy_koibpwc_kqkegzxye_epkprtl_kwcplo_aoj_ptsxt_hzhllaek
call fcn.10049280
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10004a00
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x10047070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
lea eax, [ebp - 0x188]
push 1
push eax
push 0
mov dword [ebp - 0x188], 0
call edi
cmp eax, 0x7a
jne 0x10004a5e
push dword [ebp - 0x188]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x188]
push 1
push eax
push esi
call edi
test eax, eax
je 0x10004a71
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010215
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10004a5e
push ebx
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.100152f0
push 0x80
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100152f0
push 0x80
lea eax, [ebp - 0x184]
push 0
push eax
call fcn.100152f0
mov eax, dword [esi]
add esp, 0x24
xor ebx, ebx
mov dword [ebp - 0x190], 0
test eax, eax
je 0x10004c04
xor edi, edi
test eax, eax
je 0x10004be6
lea eax, [edi*8]
sub eax, edi
push dword [esi + eax*8 + 4]
lea eax, [esi + eax*8]
mov dword [ebp - 0x18c], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100183ad
mov eax, dword [ebp - 0x18c]
add esp, 0xc
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.100183ad
mov eax, dword [ebp - 0x18c]
add esp, 0xc
push dword [eax + 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x184]
push 0x80
push eax
call fcn.100183ad
add esp, 0xc
lea eax, [ebp - 0x84]
mov ecx, 0x10041054
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10004b76
test dl, dl
je 0x10004b72
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10004b76
add eax, 2
add ecx, 2
test dl, dl
jne 0x10004b56
xor eax, eax
jmp 0x10004b7b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10004bdd
mov eax, 0x10041054
lea ecx, [ebp - 0x104]
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10004bb0
test dl, dl
je 0x10004bac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10004bb0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10004b90
xor eax, eax
jmp 0x10004bb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10004bdd
test edi, edi
jne 0x10004bc5
mov ebx, dword [esi + 0x28]
mov eax, dword [esi + 0x14]
jmp 0x10004bd7
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ecx + 0x28]
cmp ebx, eax
jbe 0x10004bdd
mov ebx, eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x190], eax
inc edi
cmp edi, dword [esi]
jb 0x10004ad2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x190]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010215
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.10010215
mov esp, ebp
pop ebp
ret
Function at 0x10005100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032b4b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10047070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.10004e70
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
call fcn.100128f4
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.10012928
lea ecx, [ebp - 0x28]
test eax, eax
je 0x1000516e
push 0xe
push str.WFDirect64.exe
jmp 0x10005175
push 0xc
push str.WFDirect.exe
call fcn.10005740
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100052a0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push 2
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0x100411a8
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.10004540
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10012152
add esp, 0xc
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x10005201
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10001780
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
push 0
cmovae ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x14], 8
push 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push ecx
push eax
mov dword [ebp - 0x30], 0
call fcn.10012b78
mov eax, dword [ebp - 0x44]
add esp, 0x14
cmp eax, 8
jb 0x10005250
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10001780
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x48], 0
test eax, eax
je 0x100052b9
push dword [ebp - 0x68]
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp - 0x60]
push eax
call fcn.10005980
mov ecx, dword [ebp - 0x5c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x64]
add esp, 0x10
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push dword [ebp - 0x64]
call fcn.100056e0
jmp 0x100052b9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.not_found__s
call fcn.1001184d
add esp, 8
lea ecx, [ebp - 0x8c]
call fcn.10012907
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100052d9
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001780
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010215
mov esp, ebp
pop ebp
ret