joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40340f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
mov ebx, ecx
push edi
push ebx
lea ecx, [ebp - 0xc]
call fcn.00411b84
push 0x41abcc
lea ecx, [ebp - 0xc]
call fcn.00411ca3
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4034ed
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpW]
push ebx
lea ecx, [ebp - 0xc]
call fcn.00411be5
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.004015ec
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0xc]
call fcn.00411ca3
test byte [ebp - 0x260], 0x10
je 0x4034b4
push 0x41abc8
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x4034cc
push 0x41abc0
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x4034cc
mov ecx, dword [ebp - 0xc]
call fcn.0040340f
jmp 0x4034c8
push 0
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x40351a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x40351a
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40345b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [0x41e794]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push 0
push ebx
call esi
test eax, eax
je 0x40351a
push ebx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
je 0x40351a
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
inc eax
jmp 0x403524
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40352a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
cmp dword [0x41e8d8], 0
push esi
mov esi, ecx
je 0x403544
xor eax, eax
inc eax
jmp 0x403588
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40353f
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x403581
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x40357d
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x403588
xor eax, eax
jmp 0x403588
mov ecx, esi
call fcn.0040340f
pop esi
leave
ret
Function at 0x4039f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 0
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
movzx ecx, word [0x41e730]
mov esi, dword [sym.imp.KERNEL32.DLL_FindResourceExA]
push ecx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
push eax
call esi
mov ebx, eax
mov edi, 0x409
test ebx, ebx
jne 0x403a3e
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
mov ebx, eax
test ebx, ebx
je 0x403a68
mov esi, dword [ebp + 8]
test esi, esi
je 0x403a51
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi], eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x403a68
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x403ad2
cmp dword [0x41e734], 0
jne 0x403ad0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.SetProcessPreferredUILanguages
push dword [0x41e75c]
mov dword [0x41e734], 1
call esi
push 0
mov ebx, eax
movzx eax, word [0x41e730]
push edi
push 0
push eax
lea eax, [ebp - 0x4c]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test ebx, ebx
jne 0x403ac6
push str.SetThreadPreferredUILanguages
push dword [0x41e75c]
call esi
mov ebx, eax
test ebx, ebx
je 0x403ad0
push 0
lea eax, [ebp - 0x4c]
push eax
push 4
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403dc8
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ecx
cmp dword [0x41e148], ebx
je 0x403dfb
mov eax, 0x41e148
cmp dword [eax], ecx
je 0x403dfb
inc esi
mov eax, esi
shl eax, 4
lea eax, [eax + 0x41e148]
cmp dword [eax], ebx
jne 0x403de7
shl esi, 4
cmp dword [esi + 0x41e148], ebx
jne 0x403e10
mov eax, 0x41aa3c
jmp 0x403f84
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x64]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea eax, [ebp - 0x64]
push eax
call ebx
mov dword [ebp - 8], eax
call edi
test eax, eax
jne 0x403ec0
mov eax, dword [ebp - 8]
xor ecx, ecx
push 2
add eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, dword [ebp - 8]
inc ecx
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x64]
push eax
call ebx
cmp eax, dword [ebp - 8]
ja 0x403eb7
call edi
test eax, eax
jne 0x403eb7
mov eax, dword [esi + 0x41e154]
test eax, eax
je 0x403eac
mov edi, dword [ebp - 4]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x403ea9
push dword [esi + 0x41e154]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov dword [esi + 0x41e154], edi
jmp 0x403ebf
push edi
jmp 0x403eba
mov eax, dword [ebp - 4]
mov dword [esi + 0x41e154], eax
jmp 0x403ec0
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [esi + 0x41e154]
test eax, eax
jne 0x403f83
mov ebx, dword [esi + 0x41e14c]
cmp dword [esi + 0x41e150], eax
je 0x403ef8
call fcn.00403d6d
cmp eax, dword [0x41ba18]
jne 0x403ef8
mov ebx, dword [esi + 0x41e150]
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [0x41e10c], 0xffffffff
pop ecx
mov dword [esi + 0x41e154], eax
jne 0x403f63
and dword [0x41e10c], 0
push 0x1f
lea eax, [ebp - 0xa4]
push eax
movzx eax, word [0x41e730]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jle 0x403f63
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
mov dword [0x41e10c], eax
lea eax, [edi + 1]
push eax
push dword [esi + 0x41e154]
push edi
push ebx
push 0
push dword [0x41e10c]
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [esi + 0x41e154]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ff2
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x404045
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x40439d
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], edx
mov esi, ecx
call fcn.00411b60
push 2
mov ecx, esi
call fcn.004042f3
mov edi, dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push eax
push 1
call edi
mov ecx, dword [esi]
xor ebp, ebp
xor edx, edx
mov dword [esi + 4], ebp
mov word [ecx], dx
cmp eax, ebp
jbe 0x4043e7
lea ebx, [eax + 1]
push ebx
mov ecx, esi
call fcn.004042f3
push eax
push ebx
call edi
mov ecx, esi
call fcn.004042d8
mov eax, dword [esi + 4]
lea ebx, [eax + 0xf]
lea edi, [eax + eax]
push ebx
mov ecx, esi
call fcn.004042f3
push ebp
push dword [esp + 0x14]
add eax, edi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esi
call fcn.004042d8
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404426
inc ebp
cmp ebp, 0xfff
jl 0x4043f0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404772
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push ebx
lea ecx, [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 4], eax
call fcn.00411b84
push 0
lea ecx, [ebp - 0x1c]
call fcn.004042f3
mov edi, eax
movzx eax, word [ebx + esi*2 - 2]
cmp eax, 0x5c
je 0x4047b0
cmp eax, 0x2f
jne 0x4047de
xor eax, eax
mov word [edi + esi*2 - 2], ax
dec esi
mov dword [ebp - 4], esi
jmp 0x4047de
movzx eax, word [edi + esi*2]
cmp eax, 0x2f
je 0x4047d0
cmp eax, 0x5c
je 0x4047d0
dec esi
test esi, esi
jg 0x4047bd
test esi, esi
je 0x404880
xor eax, eax
mov word [edi + esi*2], ax
mov ecx, edi
call fcn.0040317a
test eax, eax
je 0x4047cc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x404813
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.004044ea
test eax, eax
je 0x404813
xor esi, esi
jmp 0x4048a3
mov ecx, edi
call fcn.0040317a
test eax, eax
jne 0x40486d
push edi
push 0xc
push 1
call fcn.0040976c
add esp, 0xc
jmp 0x40480c
mov eax, dword [ebp - 4]
sub eax, esi
inc eax
push eax
mov eax, dword [ebp - 8]
lea eax, [eax + esi*2]
push eax
lea ebx, [edi + esi*2]
push ebx
call sub.MSVCRT.dll_memcpy
xor ecx, ecx
add esp, 0xc
cmp word [ebx], cx
je 0x40485f
jmp 0x40485e
movzx eax, word [edi + esi*2]
cmp eax, 0x5c
je 0x404865
cmp eax, 0x2f
je 0x404865
inc esi
cmp word [edi + esi*2], cx
jne 0x404850
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x404813
cmp esi, dword [ebp - 4]
jl 0x40482d
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
inc eax
jmp 0x4048c7
cmp dword [ebp - 4], 2
jne 0x4048b0
mov ax, word [ebx]
or ax, 0x20
cmp ax, 0x61
jb 0x4048b0
cmp ax, 0x7a
ja 0x4048b0
cmp word [ebx + 2], 0x3a
jne 0x4048b0
xor esi, esi
inc esi
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
jmp 0x4048c7
push ebx
push 0xc
push 1
call fcn.0040976c
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404dcd
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
push ebp
push esi
push edi
push 1
lea eax, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x1c], edx
mov esi, ecx
call ebx
mov ecx, esi
mov edi, eax
call fcn.00411b60
lea ebp, [edi + 2]
push ebp
mov ecx, esi
call fcn.004042f3
inc edi
push edi
push ebp
mov ecx, esi
call fcn.004042f3
push eax
push dword [esp + 0x18]
call ebx
mov ecx, esi
call fcn.004042d8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x405502
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x41e75c], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00418d50
call fcn.00403d6d
push 3
pop ecx
call fcn.00403dc8
push 0x28
pop ecx
mov dword [0x41e760], eax
call fcn.00403dc8
push 2
pop ecx
mov dword [0x41e74c], eax
call fcn.00403dc8
push 5
pop ecx
mov dword [0x41e738], eax
call fcn.00403dc8
push 0x15
pop ecx
mov dword [0x41e73c], eax
call fcn.00403dc8
push 0x16
pop ecx
mov dword [0x41e754], eax
call fcn.00403dc8
push 0x17
pop ecx
mov dword [0x41e748], eax
call fcn.00403dc8
xor ebx, ebx
mov dword [0x41e744], eax
mov dword [0x41e758], ebx
mov dword [0x41e750], ebx
xor edi, edi
push ebx
push edi
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4055f4
push edi
lea eax, [ebp - 0x5c]
push 0x41baa4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 1
lea edx, [ebp - 0x268]
lea ecx, [ebp - 0x5c]
call fcn.00405051
xor esi, esi
cmp dword [esi + 0x41e45c], edi
jne 0x4055ec
mov ecx, dword [esi + 0x41e460]
push ebx
lea edx, [ebp - 0x268]
call fcn.00405051
add esi, 8
cmp esi, 0x28
jb 0x4055d2
inc edi
cmp edi, 0x40
jl 0x405599
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405b62
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [0x41e740], 0
jne 0x405b76
mov ecx, dword [0x41e89c]
jmp fcn.0040352a
ret
Function at 0x405b8e
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x30
cmp word [eax + 2], 0x3a
push ebx
push edi
jne 0x405d3a
movzx ecx, word [eax + 4]
cmp ecx, 0x5c
je 0x405bb6
cmp ecx, 0x2f
jne 0x405d3a
mov ax, word [eax]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
je 0x405be8
push dword [ebp + 8]
jmp 0x405d3b
mov edx, str.7ZSfx_03x.cmd
lea ecx, [ebp - 0x24]
call fcn.0040439d
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405d02
push esi
lea ecx, [ebp - 0x18]
call fcn.00411b60
push str.:Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.00411be5
mov edi, str.del__
push edi
lea ecx, [ebp - 0x18]
call fcn.00411ca3
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411ce3
mov esi, 0x41bb70
push esi
lea ecx, [ebp - 0x18]
call fcn.00411ca3
push str.if_exist__
lea ecx, [ebp - 0x18]
call fcn.00411ca3
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411ce3
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.00411ca3
push edi
lea ecx, [ebp - 0x18]
call fcn.00411ca3
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411ce3
push esi
lea ecx, [ebp - 0x18]
call fcn.00411ca3
mov esi, dword [ebp - 0x14]
push 1
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00404473
mov eax, dword [eax]
xor edi, edi
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 0x30]
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, edi
pop esi
je 0x405d15
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jne 0x405d15
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push edi
push edi
push edi
push dword [ebp - 0x24]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x405d40
mov ecx, dword [ebp - 0x24]
call fcn.0040352a
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x405d41
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop ebx
leave
ret 0xc
Function at 0x405e96
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x41e78c], esi
jle 0x405ee8
mov eax, dword [0x41e788]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0xc]
call fcn.00411bba
lea ecx, [ebp - 0xc]
call fcn.0040562e
mov eax, dword [0x41e788]
push dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
inc esi
pop ecx
cmp esi, dword [0x41e78c]
jl 0x405ea7
pop esi
leave
ret
Function at 0x4071a3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.0040715e
pop esi
pop ebp
ret 4

Function at 0x408d7b
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0040769b
test eax, eax
jne 0x408d99
push eax
push eax
push esi
push 0x4083da
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
ret
push dword [0x41e738]
mov ecx, esi
push dword [esi + 4]
call fcn.00407a0f
push 0x2d
pop ecx
call fcn.00403dc8
push eax
push 0x4b2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, esi
call fcn.00407a0f
pop esi
ret
Function at 0x409278
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.00407a29
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
add eax, 2
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.00407abb
push 1
inc edi
push edi
mov ecx, esi
call fcn.00407abb
and dword [ebp - 0x2c4], 0
push 0x2b0
lea eax, [ebp - 0x2c0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
push edi
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x408190
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.00408f3f
mov ecx, esi
mov edi, eax
call fcn.004086a5
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x41117b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4111a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4111a1
xor al, al
jmp 0x4111b6
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x40103d
mov eax, dword [ebp - 4]
and eax, 0x10
cmp eax, 0
je 0x401036
jmp 0x40103d
mov eax, 1
jmp 0x401042
mov eax, 0
cmp eax, 0
mov eax, 0
setne al
leave
ret
Function at 0x401928
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx edx, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ebx
xor ebx, ebx
mov esi, esi
mov eax, edx
xor ecx, ecx
and eax, 1
test al, al
je 0x401954
nop
lea esi, [esi]
shr edx, 1
inc ecx
mov eax, edx
and eax, 1
test al, al
jne 0x401948
mov dword [esi + ebx*4], ecx
inc ebx
test edx, edx
je 0x40197b
mov al, dl
xor ecx, ecx
xor al, 1
and al, 1
test al, al
je 0x401975
shr edx, 1
inc ecx
mov al, dl
xor al, 1
and al, 1
test al, al
jne 0x401968
mov dword [esi + ebx*4], ecx
inc ebx
jmp 0x401938
mov edx, 0x10
sub edx, ecx
mov dword [esi + ebx*4], edx
inc ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x413880
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x4138e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4987e0]
test esi, esi
jle 0x4139cd
mov edi, dword [0x4987e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x413914
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4139c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x413900
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x413a0a
lea ebx, [esi + esi*2]
mov esi, dword [0x4987e4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4987e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4139ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4139bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x4139bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4987e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4139d4
add dword [0x4987e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x41391e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x4987e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x413ed0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x498b88
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x498b80]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x413f25
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x413f1e
test esi, esi
je 0x413f1e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x413f00
mov dword [esp], 0x498b88
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x414140
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x414178
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x41416e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x41417a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x414160
xor eax, eax
pop ebx
pop esi
ret