joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404155
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [0x41a8b8], 0
je 0x404197
mov eax, dword [0x41a8f4]
push eax
call fcn.00406e83
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x41933c]
je 0x404197
mov dword [0x419330], 0x23
mov eax, dword [0x419330]
jmp 0x404363
cmp dword [0x419328], 0
je 0x4041ac
mov dword [ebp - 0x218], 0
jmp 0x4041ce
push 0
push 0x403876
mov edx, dword [ebp + 8]
push edx
push 0x3ed
mov eax, dword [0x41a8ec]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
mov dword [0x41a84c], ecx
mov edx, dword [0x41a84c]
push edx
call fcn.00403d30
add esp, 4
mov dword [0x419330], eax
cmp dword [0x419330], 0
jne 0x4042ea
cmp dword [0x41a84c], 0
je 0x404228
push 0xffff0000
push 0xffffffffffffffff
push 0x465
push 0x3f2
mov eax, dword [0x41a84c]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x419324], 0
jne 0x4042ea
mov ecx, dword [0x41a8f4]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4042d6
mov dword [ebp - 8], 1
jmp 0x404271
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [0x41a8c4]
jg 0x4042d6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x41a858]
push ecx
push 0x41623c
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00401328
add esp, 8
test eax, eax
je 0x4042d4
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00407160
add esp, 0x14
mov dword [0x419330], eax
jmp 0x404268
mov ecx, dword [0x41a84c]
push ecx
call fcn.004039e5
add esp, 4
mov dword [0x419330], eax
cmp dword [0x419330], 0xfffffff6
jne 0x4042fd
mov dword [0x41932c], 1
mov dword [ebp - 8], 1
jmp 0x40430f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [0x41a8c4]
jg 0x40435e
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x41a858]
push edx
push 0x41624c
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.00401328
add esp, 8
test eax, eax
je 0x40435c
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404306
mov eax, dword [0x419330]
mov esp, ebp
pop ebp
ret
Function at 0x404367
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 8], eax
push 0x41625c
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x41a8ec]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4043cc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x41a8ec]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4043c0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
jmp 0x4043c7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
jmp 0x4043ce
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404a52
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x404
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404aad
push pe_nt_image_headers32
mov ecx, dword [0x41a8f4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x41a8f4]
push eax
call fcn.00406e83
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x41933c]
jne 0x404aa9
mov eax, 1
jmp 0x404aaf
xor eax, eax
jmp 0x404aaf
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4058b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov dword [ebp - 0x24c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.0040e3e0
add esp, 8
push 0x4162fc
lea edx, [ebp - 0x248]
push edx
call fcn.0040e3f0
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00406ee5
add esp, 4
test eax, eax
jne 0x405904
mov eax, 1
jmp 0x405a8b
cmp dword [0x41a854], 0
je 0x40591a
mov ecx, dword [0x41a854]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x405a34
mov ecx, dword [ebp - 0x140]
and ecx, 0x10
test ecx, ecx
je 0x4059ae
movsx edx, byte [ebp - 0x114]
cmp edx, 0x2e
je 0x4059ac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.0040e3e0
add esp, 8
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.0040e3f0
add esp, 8
push 0x416300
lea ecx, [ebp - 0x248]
push ecx
call fcn.0040e3f0
add esp, 8
lea edx, [ebp - 0x248]
push edx
call fcn.004058b0
add esp, 4
mov dword [ebp - 0x24c], eax
jmp 0x405a0b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405a0b
cmp dword [0x419320], 0
je 0x4059fc
lea edx, [ebp - 0x248]
push edx
call fcn.00406f5e
add esp, 4
mov eax, dword [ebp - 0x24c]
add eax, 1
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405941
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.0040e3e0
add esp, 8
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x249], 0
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405a85
cmp dword [0x419320], 0
je 0x405a85
lea edx, [ebp - 0x248]
push edx
call fcn.00406f5e
add esp, 4
mov eax, dword [ebp - 0x24c]
mov esp, ebp
pop ebp
ret
Function at 0x405e22
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x100
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004015ca
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x405f3b
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00401732
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x405e78
mov eax, 0xd
jmp 0x405f44
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00401719
add esp, 0xc
push 4
push 0x41a8e0
mov eax, dword [ebp - 4]
push eax
call fcn.004016c4
add esp, 0xc
mov ecx, dword [0x41a8e0]
push ecx
call fcn.0040de90
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [0x41a8e0]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004016c4
add esp, 0xc
push 0
mov edx, dword [0x41a8e0]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004070f6
add esp, 0xc
mov ecx, dword [0x41a8e0]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004029e4
add esp, 8
mov eax, dword [0x41a8e0]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00402bbc
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405f0e
mov eax, dword [ebp - 8]
jmp 0x405f44
mov edx, dword [0x41a8e0]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx + 4]
mov dword [0x41a8c8], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.0040170a
add esp, 4
jmp 0x405f42
mov eax, 3
jmp 0x405f44
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4061af
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x41a8f0], 0
je 0x4061c8
mov eax, dword [0x41a8f0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x41a858]
movsx edx, byte [ecx]
test edx, edx
je 0x4061f0
push 7
call fcn.00401442
add esp, 4
mov eax, dword [0x41a858]
push eax
call fcn.004058b0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x41a854], 0
je 0x406219
mov ecx, dword [0x41a854]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x406219
mov edx, dword [0x41a854]
push edx
call fcn.0040df40
add esp, 4
call fcn.004024b4
mov eax, dword [0x41a88c]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a8f4]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a858]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a8bc]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a8fc]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a900]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a8b8]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a8e8]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a884]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a8d0]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a864]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a890]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a8c0]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a874]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a868]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a83c]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a8cc]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a8f8]
push edx
call fcn.0040df40
add esp, 4
mov eax, dword [0x41a870]
push eax
call fcn.0040df40
add esp, 4
mov ecx, dword [0x41a86c]
push ecx
call fcn.0040df40
add esp, 4
mov edx, dword [0x41a8e4]
push edx
call fcn.0040df40
add esp, 4
mov dword [0x41a860], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406362
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405f48
add esp, 0xc
mov dword [0x419330], eax
cmp dword [0x419330], 0
jne 0x406391
call fcn.00405af5
mov dword [0x419330], eax
cmp dword [0x419330], 0
je 0x4063cc
cmp dword [0x419330], 0
jle 0x4063c5
cmp dword [0x419324], 0
jne 0x4063c5
push 0x10
push 1
mov eax, dword [0x419330]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00403797
add esp, 0x10
call fcn.004061af
jmp 0x4063f9
call fcn.004061af
mov dword [0x419330], eax
cmp dword [0x419330], 0
je 0x4063f9
push 0x10
push 1
mov ecx, dword [0x419330]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00403797
add esp, 0x10
mov edx, dword [0x419330]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4064dd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x120], 0
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.Dialog_d
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401a3d
add esp, 0x10
test eax, eax
jne 0x406549
push 0x104
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx ecx, byte [ebp - 0x11c]
test ecx, ecx
je 0x4065e4
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [0x41a890], 0
je 0x4065bb
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [0x41a890]
push edx
push str._s____s
mov eax, dword [0x41a88c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 0x124], eax
mov ecx, dword [0x41a88c]
push ecx
push 0
push 0x46f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4065da
lea eax, [ebp - 0x11c]
push eax
push 0
push 0x46f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x120]
mov esp, ebp
pop ebp
ret
Function at 0x406cd7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x408], 0
jmp 0x406cfb
mov eax, dword [ebp - 0x408]
add eax, 1
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0xff
jg 0x406d6a
mov ecx, dword [ebp - 0x408]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40c], 8
jmp 0x406d2b
mov edx, dword [ebp - 0x40c]
sub edx, 1
mov dword [ebp - 0x40c], edx
cmp dword [ebp - 0x40c], 0
jle 0x406d58
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x406d4e
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x406d56
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x406d1c
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x404], ecx
jmp 0x406cec
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x406dc5
mov ecx, dword [ebp + 0x10]
shr ecx, 8
and ecx, 0xffffff
mov dword [ebp - 0x410], ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 0x10]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + ecx*4 - 0x404]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x410]
xor ecx, dword [ebp - 0x414]
mov dword [ebp + 0x10], ecx
jmp 0x406d6a
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x406f5e
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7e10
call fcn.0040eaa0
mov dword [ebp - 4], 0
push 0x7d00
push 0
lea eax, [ebp - 0x7e0c]
push eax
call fcn.0040e800
add esp, 0xc
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40706e
push 0x104
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x7e10], eax
push 0x4163a4
push 0x7cff
lea ecx, [ebp - 0x7e0c]
push ecx
push 0x4163b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x407003
push 0x4163b8
lea edx, [ebp - 0x108]
push edx
push 0x4163c4
push 0x4163c8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x40706e
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp + eax - 0x7e0c]
mov dword [ebp - 4], ecx
push 0x4163d0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4163d4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4193a4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.wininit.ini
lea ecx, [ebp - 0x7e0c]
push ecx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov dword [ebp - 0x10c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407650
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x400
call fcn.0040eba0
add esp, 4
mov dword [0x4193a8], eax
mov dword [ebp - 8], 0
jmp 0x40767a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xff
jg 0x4076d6
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 8
jmp 0x40769b
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x4076c5
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x4076bb
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x4076c3
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x407692
mov eax, dword [ebp - 8]
mov ecx, dword [0x4193a8]
mov edx, dword [ebp - 4]
mov dword [ecx + eax*4], edx
jmp 0x407671
mov esp, ebp
pop ebp
ret

Function at 0x407753
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0xffffffff
je 0x4077d4
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x8000
call fcn.0040eba0
add esp, 4
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0x8000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4077c2
cmp dword [ebp - 0xc], 0
je 0x4077c2
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004076f6
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x407786
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040ead0
add esp, 4
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40913c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x409183
cmp edx, 0x10
jl 0x40916f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x40915c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x409183
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x40917b
and edx, 3
cmp edx, 3
jne 0x409197
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x40919c
cmp edx, 2
jne 0x4091a8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x4091ad
cmp edx, 1
jne 0x4091b3
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x40ebe0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415130
push 0x411738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x41a558], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x41a554], ecx
shl ecx, 8
add ecx, edx
mov dword [0x41a550], ecx
shr eax, 0x10
mov dword [0x41a54c], eax
call fcn.0040edd0
test eax, eax
jne 0x40ec4a
push 0x1c
call fcn.0040ed80
add esp, 4
mov dword [ebp - 4], 0
call fcn.00411440
call fcn.00411430
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41ce50], eax
call fcn.00411000
mov dword [0x41a520], eax
test eax, eax
je 0x40ec7d
mov eax, dword [0x41ce50]
test eax, eax
jne 0x40ec87
push 0xffffffffffffffff
call fcn.0040f690
add esp, 4
call fcn.00410d50
call fcn.00410c60
call fcn.0040f660
mov esi, dword [0x41ce50]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x40ed66
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x40ecce
test al, al
je 0x40ecce
and eax, 0xff
push eax
call fcn.00410c00
add esp, 4
test eax, eax
je 0x40eca8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40eca8
cmp byte [esi], 0x22
jne 0x40ecd7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x40ece7
cmp al, 0x20
ja 0x40ece7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40ecd7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40ed08
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40ed0d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0040f690
jmp 0x40ed4b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40ecd7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40ed66

Function at 0x40f6d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x41a588]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x40f6ef
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x41a584], 1
mov byte [0x41a580], bl
jne 0x40f749
mov ecx, dword [0x41ce48]
test ecx, ecx
je 0x40f737
mov esi, dword [0x41ce44]
sub esi, 4
cmp esi, ecx
jb 0x40f737
mov eax, dword [esi]
test eax, eax
je 0x40f730
call eax
mov ecx, dword [0x41ce48]
sub esi, 4
cmp esi, ecx
jae 0x40f722
push 0x41601c
push 0x416014
call fcn.0040f780
add esp, 8
push 0x416024
push 0x416020
call fcn.0040f780
add esp, 8
test ebx, ebx
jne 0x40f770
push ebp
mov dword [0x41a588], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x411000
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x41a6a8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x411042
call edi
mov esi, eax
test esi, esi
je 0x41102c
mov eax, 1
jmp 0x41103d
call ebp
mov ebx, eax
test ebx, ebx
je 0x41114f
mov eax, 2
mov dword [0x41a6a8], eax
cmp eax, 1
jne 0x4110e2
test esi, esi
jne 0x41105b
call edi
mov esi, eax
test esi, esi
je 0x41114f
cmp word [esi], 0
mov eax, esi
je 0x411075
add eax, 2
cmp word [eax], 0
jne 0x411063
add eax, 2
cmp word [eax], 0
jne 0x411063
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4110d4
push edi
call fcn.0040de90
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4110d4
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4110c6
push ebx
call fcn.0040df40
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x41114f
test ebx, ebx
jne 0x4110f3
call ebp
mov ebx, eax
test ebx, ebx
je 0x41114f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x41110b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4110fb
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4110fb
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.0040de90
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x41112d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret