joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450774
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c7469
call fcn.004c6ae8
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x20], ebx
mov eax, ecx
mov dword [ebp - 0x24], eax
xor esi, esi
mov edi, esi
mov dword [ebp - 0x14], esi
add eax, eax
cmp edi, eax
jae 0x45087f
mov dword [ebp - 0x1c], 0x5c2f
cmp dword [ebp - 0x1c], 0x5f0a
jle 0x45080d
push esi
push 0xf84
push esi
push esi
push esi
push esi
call dword [0xade24c]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov esi, ebx
mov ebx, 0x6406
mov eax, esi
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xadaa58
call fcn.00438300
dec esi
dec ebx
jne 0x4507d0
mov ebx, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0xc36
jl 0x4507c9
inc edi
cmp edi, 0xdac
push 0
pop esi
jl 0x4507c4
push esi
call dword [0xade130]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov eax, edi
xor edx, edx
push 0x29
pop ecx
div ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + edx*4]
mov ecx, dword [ebx + edi*4]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
add ecx, edx
mov dword [ebx + edi*4], ecx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x58de
jge 0x450847
mov edx, 0xac3480
mov ecx, 0xadaa58
call fcn.0043ab89
or dword [ebp - 4], 0xffffffff
jmp 0x450873
inc edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x24]
jmp 0x450798
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e50
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0x40ba60
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
cmp eax, 0xff
ja 0x401ea0
test eax, eax
mov ebp, 0x40ba60
mov eax, 0
cmove ebp, eax
add esp, 0x1c
pop ebx
pop esi
mov eax, ebp
pop edi
pop ebp
ret
lea eax, [eax + eax + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebp, eax
test eax, eax
je 0x401ecc
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
mov eax, ebp
sub esp, 0xc
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.Could_not_allocate_environment_buffer
mov dword [esp], 0x68
call fcn.00401d50
Function at 0x402520
Capabilities:
Read .ini file

Disassembly:
push ebx
sub esp, 0x28
mov dword [esp + 0x10], str.pythonX
mov dword [esp + 0xc], str.py__ls
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x400
mov dword [esp], 0x40b040
call dword [sym.imp.msvcrt.dll__snwprintf_s]
mov eax, 0x40b040
call fcn.00401e50
mov ebx, eax
mov eax, str.environment
test ebx, ebx
je 0x402590
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.pythonX
mov dword [esp], str.found_configured_value__ls_ls_in__ls_n
call fcn.00401620
add esp, 0x28
mov eax, ebx
pop ebx
ret
cmp word [0x44b600], 0
jne 0x402610
cmp word [0x44b3e0], 0
je 0x4025f0
mov dword [esp + 0x14], 0x44b3e0
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], 0x40b040
mov dword [esp + 8], 0
mov dword [esp + 4], str.pythonX
mov dword [esp], str.defaults
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub esp, 0x18
test eax, eax
je 0x4025f0
mov eax, 0x44b3e0
mov ebx, 0x40b040
jmp 0x402566
mov dword [esp + 4], str.pythonX
mov dword [esp], str.found_no_configured_value_for__ls_n
call fcn.00401620
add esp, 0x28
mov eax, ebx
pop ebx
ret
mov dword [esp + 0x14], 0x44b600
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], 0x40b040
mov dword [esp + 8], 0
mov dword [esp + 4], str.pythonX
mov dword [esp], str.defaults
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub esp, 0x18
test eax, eax
je 0x40259a
mov eax, 0x44b600
mov ebx, 0x40b040
jmp 0x402566
Function at 0x402ab0
Capabilities:
Read .ini file

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1038
call fcn.004050b0
sub esp, eax
mov eax, dword [esp + eax]
lea esi, [esp + 0x30]
mov dword [esp + 0x10], 0x400
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40805c
mov dword [esp + 0x24], eax
call eax
sub esp, 0x18
cmp eax, 0x3ff
je 0x402cb8
cmp word [esp + 0x30], 0
mov ebx, dword [sym.imp.msvcrt.dll_isspace]
lea edi, [esp + 0x830]
je 0x402bfc
lea esi, [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x40805c
call eax
sub esp, 0x18
cmp eax, 0x3ff
je 0x402c10
movzx eax, word [esp + 0x830]
mov ebp, edi
test ax, ax
jne 0x402b84
jmp 0x402be6
movzx eax, word [ebp + 2]
add ebp, 2
test ax, ax
je 0x402be6
mov dword [esp], eax
call ebx
test eax, eax
jne 0x402b78
mov eax, esi
call fcn.00402a50
mov edx, eax
test eax, eax
je 0x402c30
mov dword [esp], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
add edx, 0x208
mov dword [esp + 4], 0x400
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x402b28
add esp, 0x103c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], str.read_commands:__ls:_not_enough_space_for__ls_n
mov dword [esp + 4], eax
call fcn.00401620
jmp 0x402b63
mov eax, dword [0x40c688]
cmp eax, 0x63
jle 0x402c50
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.cant_add__ls___ls:_no_room_n
call fcn.00401620
jmp 0x402be6
lea edx, [eax + 1]
mov ecx, dword [sym.imp.msvcrt.dll_wcsncpy_s]
mov dword [esp + 8], esi
mov dword [0x40c688], edx
imul edx, eax, 0xa08
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], 0xffffffff
lea eax, [edx + 0x40c6a0]
mov dword [esp + 0x2c], edx
mov dword [esp + 4], 0x104
mov dword [esp], eax
call ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0xffffffff
lea eax, [edx + 0x40c8a8]
mov dword [esp + 4], 0x400
mov dword [esp], eax
call ecx
jmp 0x402be6
mov eax, dword [esp + 0x20]
mov dword [esp], str.read_commands:__ls:_not_enough_space_for_names_n
mov dword [esp + 4], eax
call fcn.00401620
jmp 0x402b0c
Function at 0x404aa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x458b98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x458b90]
sub esp, 4
test ebx, ebx
je 0x404af5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x404aee
test esi, esi
je 0x404aee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404ad0
mov dword [esp], 0x458b98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100026c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002721
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100026e2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x100022f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002351
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002312
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x401d25
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1b0]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
push eax
xor ebx, ebx
push ebx
push 0xfde9
mov dword [ebp - 0x6c], 0xfffffffd
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x401e01
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x401e01
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x401e00
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401df3
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x40e484
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401df3
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x70]
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x1a4
leave
ret

Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7

Function at 0x40269e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4026ad
pop dword [ebp - 0x4c]
mov eax, 0x64f466d0
add eax, 0x9b4bbfdd
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3c52d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x668342a
sub ecx, 0x667e1ab
xor edx, edx
add edx, eax
mov ebx, 0x2ce83d5d
add ebx, 0xd3593aa3
add ebx, dword [ebp - 0x4c]
mov edi, 0x50cf854e
add edi, 0x19bbeac0
add dword [ebp - 0x30], 0xee41914
mov esi, dword [ebx]
add dword [ebp - 0x28], 0x7a1ea0bc
xor esi, edi
add dword [ebp - 0x44], 0x90c64112
mov dword [edx], esi
mov dword [ebp - 0x28], 0x3e5c8dbf
add edx, 0x8a64336f
add edx, 0x759bcc95
add ebx, 4
loop 0x402709
add eax, 0xb860dff8
add eax, 0x47a05cd7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb05bb73d
sub ecx, 0xb01bb73d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x29a0206a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x29a02079
pop dword [ebp - 0x20]
mov eax, 0xe8d7d9aa
sub eax, 0xbf37b931
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x34aef68f
sub dword [ebp - 0x30], 0xe65cb144
mov dword [ebp - 0x2c], 0x720c901
add dword [ebp - 0x2c], 0x2b128344
mov dword [ebp - 0x28], 0x8639bd04
add dword [ebp - 0x28], 0xc612872a
mov dword [ebp - 0x24], 0x24e9e856
add dword [ebp - 0x24], 0xdb1617aa
lea eax, [ebp - 0x30]
push eax
mov eax, 0x85dc175b
add eax, 0xa3c4f91d
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xeadc0270
add dword [ebp - 0x30], 0x899666e6
mov dword [ebp - 0x2c], 0x1f7059c8
add dword [ebp - 0x2c], 0x21fc07ad
mov dword [ebp - 0x28], 0x312a7470
add dword [ebp - 0x28], 0x3244f7fc
mov dword [ebp - 0x24], 0xb310d264
sub dword [ebp - 0x24], 0xb310d264
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xd8863521
add eax, 0x511adb4f
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38704
push 0
call eax
mov ecx, 0x51fa2125
add ecx, 0xae06216c
mov edi, eax
mov edx, 0x6add8ab2
sub edx, 0x413ba0b2
add edx, dword [ebp - 0x20]
mov esi, 0xf69adc0a
add esi, 0x67adc950
mov dword [ebp - 8], 0x442fdddb
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0x1fa266d4
xor ebx, esi
xor dword [ebp - 0x18], 0x14114464
mov dword [edi], ebx
add edi, 4
add edx, 0x12b8d479
add edx, 0xed472b8b
loop 0x29a0219b
add eax, 0x822c618
sub eax, 0x821c901
mov ebx, eax
add eax, 0xb3e21cca
sub eax, 0xb3e21cc5
mov ecx, 0x8a630fa6
sub ecx, 0x60c30fa6
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000983f
pop dword [ebp - 8]
mov eax, 0xfbe06b35
add eax, 0x14202d0a
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3641b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x74eba2ec
sub ecx, 0x74eb65e7
mov ebx, eax
mov edi, 0xbe356c42
sub edi, 0xae33e642
add edi, dword [ebp - 8]
mov edx, 0x35fbd498
sub edx, 0xd4bd6078
mov esi, dword [edi]
add dword [ebp - 4], ebx
xor esi, edx
xor dword [ebp - 4], ecx
mov dword [ebx], esi
add ebx, 0xaddd11e
sub ebx, 0xaddd11a
add edi, 0x23322c3f
sub edi, 0x23322c3b
loop 0x10009899
add eax, 0xe6e7
mov ebx, eax
add eax, 0xf22f3f50
add eax, 0xdd0c0b5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x402820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402839
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402876
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402872
nop word [eax + eax]
cmp esi, edx
jae 0x402876
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402860
cmp esi, edx
jb 0x40287d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403c20
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43083b
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x470], ebx
push 0x250
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.0041c000
mov ecx, dword [ebx + 0x1c]
add esp, 0xc
sub ecx, 0x10
call fcn.00401d30
add eax, 0x10
mov dword [ebp - 0x46c], eax
push 6
push 0x44001c
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], 0
call fcn.00407870
mov esi, dword [ebp - 0x46c]
lea eax, [ebp - 0x468]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x403d15
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041c000
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov esi, dword [ebp - 0x470]
lea eax, [ebp - 0x43c]
push eax
push dword [esi + 0x1c]
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x468]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403cd6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x46c]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403d34
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419174
mov esp, ebp
pop ebp
ret
Function at 0x4041e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4308ef
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x44700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004044b0
add esi, 0x208
mov dword [ebp - 4], 0
push 0x440064
push esi
call fcn.0041ad04
mov edx, dword [ebp - 0x10]
neg eax
mov ecx, esi
sbb eax, eax
neg eax
push eax
call fcn.0040c150
add esp, 0xc
or esi, 0xffffffff
cmp eax, 1
jne 0x404347
mov eax, dword [0x448ebc]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x404288
push 0x20
call fcn.0041965a
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004126f0
mov byte [ebp - 4], 0
mov dword [0x448ebc], eax
test eax, eax
jne 0x404288
xor ecx, ecx
mov dword [ecx], 1
lea ecx, [eax + 0x14]
xor eax, eax
cmp eax, dword [ecx]
push 0
push 0x80
push 3
sbb eax, eax
and eax, ecx
push eax
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
sub esp, 0x10
mov ecx, edi
call fcn.0040c600
add esp, 0x10
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
cmp esi, dword [eax + 0x1208]
jne 0x404332
push eax
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.004044b0
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404590
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
test al, al
mov eax, esi
je 0x404317
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404313
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, 1
jmp 0x404359
mov dword [ebx + 0x38], 0x39d
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404357
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x404357
push dword [ebp - 0x10]
mov dword [ebx + 0x38], 0xcf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or esi, 0xffffffff
jmp 0x404357
mov dword [ebx + 0x38], 0x395
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x3c], eax
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x404378
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4044b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430969
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x44700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004026f0
mov ecx, eax
test ecx, ecx
jne 0x4044fe
push 0x80004005
call fcn.00402be0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
test ebx, ebx
je 0x40457a
push ebx
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
test eax, eax
jle 0x404553
nop dword [eax]
push esi
push ebx
push str._s__u.tmp
push edi
call fcn.00407a40
add esp, 0x10
inc esi
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40457a
test esi, esi
jne 0x404530
jmp 0x40457a
mov eax, dword [ebp - 0x14]
push esi
push ebx
push dword [eax + 0x1c]
push str._s_s__u.tmp
push edi
call fcn.00407a40
add esp, 0x14
inc esi
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40457a
test esi, esi
jne 0x404553
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x407a60
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0x7d0
jbe 0x407aa4
push 0x10
push str.Error_
push 0x440ba0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00419174
mov esp, ebp
pop ebp
ret
call fcn.00411a00
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041c000
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x3c
lea eax, [ebp - 0xa48]
push 0
push eax
call fcn.0041c000
add esp, 0xc
mov dword [ebp - 0xa48], 0x3c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0xa40], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xa44], 0x500
mov dword [ebp - 0xa3c], str.open
mov dword [ebp - 0xa38], eax
jb 0x407b24
mov esi, dword [esi]
lea eax, [ebp - 0xa48]
mov dword [ebp - 0xa34], esi
push eax
mov dword [ebp - 0xa2c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x407b94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x4c7
je 0x407a93
push 0x800
lea eax, [ebp - 0xa0c]
push 0
push eax
call fcn.0041c000
push esi
lea eax, [ebp - 0xa0c]
push str.NGM_Execute_Failed___error_code_d__r_n
push eax
call fcn.00407ba0
add esp, 0x18
lea eax, [ebp - 0xa0c]
push 0x10
push str.ERROR_
push eax
jmp 0x407a8b
push 0
call fcn.004216a1
int3