joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40720c
Capabilities:
Authenticate hmac

Disassembly:
jl 0x40720d
add al, ch
push cs
out 2, eax
add byte [ecx + 0x437b90], ah
sub eax, eax
mov edi, dword [0x437b9c]
add edi, eax
push 2
mov dword [0x437978], edx
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379f4]
add edi, eax
mov eax, dword [0x437958]
mov eax, dword [0x437bec]
mov esi, dword [0x437a64]
mov si, 0x83
push esi
push dword [0x437958]
pop eax
jns 0x407252
add al, ch
leave
out 2, al
add byte [ebx + 0x437b583d], cl
add byte [ecx], ch
jmp dword [ecx + 0x437a28]
mov esi, 0x20
push edi
mov dword [0x437d18], eax
push 0xcf
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b34]
add eax, edx
mov eax, dword [0x437a98]
add edx, eax
mov edi, dword [0x437b34]
push edi
push 0x59
call sub.USER32.dll_GetWindow
jns 0x407252
add al, ch
leave
out 2, al
add byte [ebx + 0x437b583d], cl
add byte [ecx], ch
jmp dword [ecx + 0x437a28]
add al, byte [eax]
mov eax, dword [0x437c5c]
mov ax, 0x80
mov eax, dword [0x437aa8]
push 0xae
sbb eax, dword [0x437b28]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a1c]
sub eax, ecx
mov eax, dword [0x437958]
and edx, eax
push eax
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379dc]
mov eax, 0x7f
mov eax, dword [0x43797c]
mov esi, 0xba
push 0x10
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b94]
add eax, esi
mov edi, dword [0x437a50]
mov dword [0x437a30], eax
push dword [0x437b14]
push edi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437be4]
sub esi, eax
mov edi, 2
mov eax, dword [0x437b8c]
or eax, eax
push eax
push dword [0x437a48]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437964]
mov edi, 0x10
mov eax, dword [0x437c30]
add eax, eax
push dword [0x437b64]
push edi
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b00]
mov ax, 0x80
mov eax, 0x80
mov dword [0x437980], eax
push dword [0x437c4c]
push dword [0x437ca0]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b4c]
add eax, eax
mov edi, dword [0x437bd4]
sub edi, esi
push edi
push 0xaf
call sub.USER32.dll_GetWindow
mov eax, dword [0x43797c]
add eax, edx
mov esi, dword [0x437a5c]
sub eax, ecx
mov ecx, dword [0x437b88]
mov esi, dword [0x437d40]
push esi
sub eax, eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ac4]
mov ax, 4
push eax
push edi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437cb4]
mov eax, 0x80
mov eax, dword [0x437c80]
add edx, eax
invalid
Function at 0x407469
Capabilities:
Authenticate hmac

Disassembly:
push dword [0x437c38]
mov eax, dword [0x437990]
sub eax, edx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437abc]
mov ax, 0xf3
mov eax, dword [0x437c60]
mov di, 0xa6
mov eax, dword [0x437c7c]
push ecx
push 8
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cb4]
sub eax, eax
mov ecx, dword [0x437ca8]
mov dx, 0xd1
mov esi, dword [0x437d24]
push edx
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d40]
add edx, eax
mov eax, dword [0x4379f4]
mov esi, 0x10
mov ecx, dword [0x437958]
mov dword [0x437a38], edx
push dword [0x437ba8]
add edi, eax
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ab4]
mov ax, 0xc0
or eax, esi
mov ecx, 0x10
push 8
mov eax, dword [0x437bcc]
add eax, eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d24]
add edx, edx
mov eax, 8
add edx, esi
push ecx
sub edx, eax
push edx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a5c]
mov cx, 0x47
mov eax, dword [0x4379d0]
add esi, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cdc]
mov edi, 2
mov eax, dword [0x437bec]
mov eax, dword [0x437b04]
and edx, eax
push dword [0x437b5c]
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437ae0]
sub eax, edi
mov edx, dword [0x437b50]
add eax, eax
sub esi, eax
add edx, eax
push edx
mov dword [0x4379dc], edx
invalid

Function at 0x4076e6
Capabilities:
Authenticate hmac

Disassembly:
mov esi, dword [0x437d20]
mov edx, 0x80
Function at 0x4076f1
Capabilities:
Authenticate hmac

Disassembly:
mov esi, dword [0x437a94]
sub eax, eax
mov eax, dword [0x437b4c]
add esi, edx
push 2
add ecx, ecx
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437a1c]
add esi, edx
mov edi, dword [0x437cb0]
mov eax, dword [0x437bf8]
push eax
sub eax, edi
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437cb4]
xor ecx, eax
mov edi, dword [0x437c90]
add eax, eax
mov edx, 0x20
mov eax, dword [0x437b04]
push eax
push dword [0x437988]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, eax
mov eax, dword [0x4379e4]
add eax, eax
mov dword [0x437d0c], edx
push 8
mov eax, dword [0x437a3c]
sub eax, edi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d40]
mov si, 2
mov eax, dword [0x437970]
sub eax, eax
sub edx, eax
push dword [0x437a4c]
xor eax, dword [0x437a84]
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437958]
mov edi, 1
mov ax, 0xe5
push 1
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bc4]
mov si, 0x51
mov edx, dword [0x437acc]
push dword [0x437d14]
push dword [0x437ab0]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d48]
mov eax, 1
sub eax, eax
sub eax, eax
push eax
mov dword [0x437958], eax
push dword [0x4379b4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379c8]
sub ecx, edi
mov eax, dword [0x437bd8]
sub ecx, ecx
push eax
sub eax, edx
push eax
call sub.USER32.dll_GetWindow
loopne 0x407801
add byte [ecx + 0x437bf8], ah
and edi, eax
mov edi, dword [0x437bc4]
mov esi, 2
push 0x80
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437be8]
jnp 0x407869
add byte [ecx], ah
shl byte [esi - 0x48], 9
add byte [ecx + 0x437c40], ah
mov esi, dword [eax]
add esi, eax
mov esi, dword [eax]
mov eax, dword [0x437aa8]
Function at 0x4077fd
Capabilities:
Authenticate hmac

Disassembly:
mov esi, dword [0x437a94]
sub eax, eax
mov eax, dword [0x437b4c]
add esi, edx
push 2
add ecx, ecx
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437a1c]
add esi, edx
mov edi, dword [0x437cb0]
mov eax, dword [0x437bf8]
push eax
sub eax, edi
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437cb4]
xor ecx, eax
mov edi, dword [0x437c90]
add eax, eax
mov edx, 0x20
mov eax, dword [0x437b04]
push eax
push dword [0x437988]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, eax
mov eax, dword [0x4379e4]
add eax, eax
mov dword [0x437d0c], edx
push 8
mov eax, dword [0x437a3c]
sub eax, edi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d40]
mov si, 2
mov eax, dword [0x437970]
sub eax, eax
sub edx, eax
push dword [0x437a4c]
xor eax, dword [0x437a84]
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437958]
mov edi, 1
mov ax, 0xe5
push 1
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bc4]
mov si, 0x51
mov edx, dword [0x437acc]
push dword [0x437d14]
push dword [0x437ab0]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d48]
mov eax, 1
sub eax, eax
sub eax, eax
push eax
mov dword [0x437958], eax
push dword [0x4379b4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379c8]
sub ecx, edi
mov eax, dword [0x437bd8]
sub ecx, ecx
push eax
sub eax, edx
push eax
call sub.USER32.dll_GetWindow
loopne 0x407801
add byte [ecx + 0x437bf8], ah
and edi, eax
mov edi, dword [0x437bc4]
mov esi, 2
push 0x80
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437be8]
jnp 0x407869
add byte [ecx], ah
shl byte [esi - 0x48], 9
add byte [ecx + 0x437c40], ah
mov esi, dword [eax]
add esi, eax
mov esi, dword [eax]
mov eax, dword [0x437aa8]
Function at 0x407824
Capabilities:
Authenticate hmac

Disassembly:
jnp 0x407869
add byte [ecx], ah
shl byte [esi - 0x48], 9
add byte [ecx + 0x437c40], ah
push dword [0x437d4c]
mov dword [0x437ac4], eax
push 2
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c8c]
sub eax, eax
mov eax, dword [0x437d1c]
mov ecx, 0x57
add eax, edi
push eax
push dword [0x437d48]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437d48]
and eax, edi
add byte [ecx], ah
clc
mov edi, dword [0x437ca0]
mov edx, dword [0x437af8]
push dword [0x437c20]
add edx, edx
push edx
call sub.USER32.dll_GetWindow
add eax, dword [0x437c94]
mov ax, 0x4c
add esi, eax
push dword [0x437b7c]
mov dword [0x437bf4], edx
push dword [0x437d34]
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437c38]
mov ecx, 2
mov edi, dword [0x437958]
push dword [0x437aa4]
push dword [0x437964]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c30]
mov esi, 0xd7
mov ecx, dword [0x437aa8]
push 0x40
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437994]
mov eax, 1
mov eax, dword [0x437c10]
push esi
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437958]
add eax, edi
mov ecx, dword [0x437a6c]
sub edi, edi
mov esi, dword [0x437c68]
mov ax, 0x40
mov dword [0x437b3c], eax
push dword [0x437a74]
add eax, eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a60]
mov edi, 0x78
mov esi, dword [0x437bfc]
sub eax, edx
push 0x1c
push eax
call sub.USER32.dll_GetWindow
add eax, dword [0x437bb4]
mov ecx, 6
add edx, esi
mov eax, dword [0x437af0]
sub edi, eax
push edi
mov ecx, dword [0x437b28]
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b90]
add eax, eax
mov esi, dword [0x437988]
mov ax, 2
mov eax, 0x20
push dword [0x437b7c]
sub eax, esi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bbc]
add eax, edi
mov esi, dword [0x437c54]
mov eax, 0xa1
mov eax, dword [0x4379a0]
push eax
or dword [0x437a28], 0xffff
push 0x80
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a7c]
mov si, 4
mov edi, dword [0x437958]
mov cx, 0x20
push ecx
push dword [0x437cf4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d00]
add eax, ecx
sub edi, ecx
mov eax, dword [0x4379a4]
push eax
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437aac]
and edx, ecx
mov edi, 0x8b
mov ecx, dword [0x4379cc]
add eax, eax
mov ecx, dword [0x437d48]
push ecx
mov esi, dword [0x437c54]
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a1c]
sub eax, eax
mov esi, dword [0x437af4]
sub esi, ecx
mov edi, dword [0x437c9c]
sub ecx, edi
push 0x43780e
call sub.KERNEL32.dll_LoadLibraryA
mov edx, eax
invalid
invalid
invalid
invalid
Function at 0x401d5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e120]
jne 0x401d67
repz ret
jmp fcn.004032a0

Function at 0x421d93
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b1bc
and dword [ebp - 4], 0
cmp dword [0x51847c], 0
mov ebx, eax
jne 0x421e44
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421ef5
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421ef5
push eax
call fcn.0040b14a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x51847c], eax
call esi
push eax
call fcn.0040b14a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x518480], eax
call esi
push eax
call fcn.0040b14a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x518484], eax
call esi
push eax
call fcn.0040b14a
pop ecx
mov dword [0x51848c], eax
test eax, eax
je 0x421e44
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b14a
pop ecx
mov dword [0x518488], eax
mov eax, dword [0x518488]
cmp eax, ebx
je 0x421e9c
cmp dword [0x51848c], ebx
je 0x421e9c
push eax
call fcn.0040b1c5
push dword [0x51848c]
mov esi, eax
call fcn.0040b1c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421e9c
test edi, edi
je 0x421e9c
call esi
test eax, eax
je 0x421e93
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421e93
test byte [ebp - 0xc], 1
jne 0x421e9c
or dword [ebp + 0x10], 0x200000
jmp 0x421ed5
mov eax, dword [0x518480]
cmp eax, ebx
je 0x421ed5
push eax
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ed5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421ed5
mov eax, dword [0x518484]
cmp eax, ebx
je 0x421ed5
push eax
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ed5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x51847c]
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ef5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421ef7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428530
Capabilities:
Get geographical location
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42e120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x518560
lea edx, [eax + 1]
jmp 0x428550
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428550
sub eax, edx
cmp eax, 0xb05b7
jne 0x4285ed
cmp dword [0x4d7f934], 0x212
jne 0x42857c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
cmp dword [0x4d7f934], 0x3d3
jne 0x42859b
push 0
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push 4
push str.duku
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x408], 0xf
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x41c], 0
call fcn.00401330
push str.Wire_daduwi__s__d__f
call fcn.00402393
add esp, 4
cmp dword [ebp - 0x408], 0x10
jb 0x4285ed
mov ecx, dword [ebp - 0x41c]
push ecx
call fcn.00402409
add esp, 4
mov eax, dword [0x4d7f934]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GlobalDeleteAtom]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
xor esi, esi
cmp eax, 0x976
jne 0x42861f
push 0
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x4d7f934]
cmp eax, 0xcd2
jne 0x428635
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetSystemTimeAdjustment]
mov eax, dword [0x4d7f934]
cmp esi, 0x21e49f
jle 0x428649
cmp dword [ebp - 0x418], 0x7239c9ee
jne 0x4286aa
inc esi
cmp esi, 0x38f964ff
jl 0x428603
xor esi, esi
cmp eax, 0xd47
jne 0x428679
mov edx, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x424]
push esi
push esi
push edx
lea eax, [ebp - 0x404]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExW]
call fcn.004280c0
cmp dword [0x4d7f934], 0x5aa
jne 0x428695
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileWithProgressA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401d5d
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
mov dword [0x4d7f590], esi
mov dword [0x4d7f594], esi
cmp eax, 0x801
jne 0x428654
mov dword [0x4d7f928], esi
jmp 0x428679
Function at 0x401448
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004029e4
test esi, esi
jne 0x40147e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00402ad0
jmp 0x40149c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040135c
mov edi, eax
test esi, esi
je 0x40149c
cmp dword [ebx], 0
je 0x40149c
dec esi
jmp 0x401485
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x401b5c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x427008], 0x8088405
inc edx
mov dword [ebx + 0x427008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404918
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402e48
xor eax, eax
push ebp
push 0x40498a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004029e4
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00402e58
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov ecx, ebx
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.004052e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404991
lea eax, [ebp - 4]
call fcn.004029e4
ret

Function at 0x404998
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004029e4
xor eax, eax
push ebp
push 0x4049ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea esi, [ebx + 1]
mov eax, esi
call fcn.004011dc
mov dword [ebp - 8], eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
call sub.user32.dll_GetWindowTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049f4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00402bd0
ret
Function at 0x404a0c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 1
je 0x404adb
xor eax, eax
push ebp
push 0x404ad1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push 0x404ae4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x404adb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404f78
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402e48
mov eax, dword [ebp - 8]
call fcn.00402e48
xor eax, eax
push ebp
push 0x404fec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00402da4
jne 0x404fb4
xor ebx, ebx
jmp 0x404fd1
mov eax, dword [ebp - 8]
call fcn.00402e58
push eax
mov eax, dword [ebp - 4]
call fcn.00402e58
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ff3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402a08
ret
Function at 0x404ffc
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402e48
lea edi, [ebp - 0x148]
xor eax, eax
push ebp
push 0x405178
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00402c60
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x40505f
lea eax, [ebp - 4]
mov edx, 0x405190
call fcn.00402c68
push edi
lea eax, [ebp - 0x14c]
mov ecx, 0x40519c
mov edx, dword [ebp - 4]
call fcn.00402cac
mov eax, dword [ebp - 0x14c]
call fcn.00402e58
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x40514d
lea eax, [ebp - 8]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00402c48
mov eax, dword [ebp - 8]
mov edx, 0x4051a8
call fcn.00402da4
je 0x40511e
mov eax, dword [ebp - 8]
mov edx, 0x4051b4
call fcn.00402da4
je 0x40511e
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4050c8
test al, 0x10
jne 0x4050cc
xor eax, eax
jmp 0x4050ce
mov al, 1
test al, al
jne 0x405102
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00402cac
mov eax, dword [ebp - 8]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0x150]
call fcn.00402bd0
mov eax, dword [ebp - 0x150]
call fcn.00405e60
jmp 0x40511e
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00402cac
mov eax, dword [ebp - 0x154]
call fcn.00404ffc
push edi
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x40508f
push esi
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.00402e58
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
je 0x40514d
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40517f
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00402a08
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402a08
ret
Function at 0x4052e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4053c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004029e4
test esi, esi
je 0x40533a
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0x4270cc]
lea eax, [ebp - 4]
call fcn.00402bc0
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00402cac
shr esi, 4
test esi, esi
jne 0x40530f
cmp dword [ebx], 0
jne 0x40535c
jmp 0x40534f
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x4053d8
call fcn.00402cac
mov eax, dword [ebx]
call fcn.00402c60
cmp edi, eax
jg 0x405341
jmp 0x4053ad
mov eax, dword [ebx]
call fcn.00402c60
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0x4053a2
mov eax, dword [ebx]
call fcn.00402c60
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00402ef4
mov edx, ebx
mov ecx, 1
mov eax, 0x4053e4
call fcn.00402f3c
jmp 0x4053a2
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x4053d8
call fcn.00402cac
mov eax, dword [ebx]
call fcn.00402c60
cmp edi, eax
jg 0x405394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053ca
lea eax, [ebp - 4]
call fcn.004029e4
ret

Function at 0x405598
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402e48
xor eax, eax
push ebp
push 0x4055ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00402e58
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
or ebx, 2
or ebx, 1
or ebx, 4
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4055f6
lea eax, [ebp - 4]
call fcn.004029e4
ret

Function at 0x4055fc
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
push esp
push ecx
push 0
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_SetThreadPriority
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x405620
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4057dc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402e48
xor eax, eax
push ebp
push 0x40588a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004029e4
mov eax, dword [ebp - 4]
call fcn.00405df4
test al, al
je 0x405874
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00402e58
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
push 0
push edi
call sub.kernel32.dll_GetFileSize_1
mov dword [ebx], eax
mov eax, dword [ebx]
call fcn.004011dc
mov esi, eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
push eax
push esi
push edi
call sub.kernel32.dll_ReadFile_1
mov ecx, dword [ebx]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00402ad0
mov edx, dword [ebx]
mov eax, esi
call fcn.004011f4
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405891
lea eax, [ebp - 4]
call fcn.004029e4
ret