joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x43d226
call fcn.0041fdeb
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x406747
call fcn.0040518b
mov esi, eax
jmp 0x406851
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x406760
call fcn.0040518b
jmp 0x406843
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x406756
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x40679d
mov esi, 0x8007000e
jmp 0x406845
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x4067b2
cmp eax, 0xffffffff
jbe 0x4067bc
push 0x80070216
call fcn.00402cff
cmp eax, 0x400
jbe 0x4067e9
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00405701
jmp 0x4067f5
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x406793
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x406756
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.0040658f
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40686a
lea eax, [ebp - 0x418]
call fcn.004056f8
mov eax, esi
call fcn.0041fe47
ret 0xc
Function at 0x408ab3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x44e234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x408bee
push ebx
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x408bed
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408af9
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x220]
call fcn.00401f96
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x408b1f
mov eax, dword [esi]
jmp 0x408b21
mov eax, esi
push eax
call fcn.0041b391
pop ecx
test eax, eax
jne 0x408bed
push str.DoneEx
push 7
pop edi
mov eax, esi
call fcn.00403a31
cmp dword [esi + 0x14], ebx
jb 0x408b48
mov eax, dword [esi]
jmp 0x408b4a
mov eax, esi
push eax
call fcn.0041b391
pop ecx
test eax, eax
je 0x408b6b
cmp dword [esi + 0x14], ebx
jb 0x408b5e
mov eax, dword [esi]
jmp 0x408b60
mov eax, esi
push eax
call fcn.0041b4bd
pop ecx
test eax, eax
jne 0x408be1
push str.XCell_Compiler
push 0xf
pop edi
mov eax, esi
call fcn.00403a31
cmp dword [esi + 0x14], ebx
jb 0x408b83
mov eax, dword [esi]
jmp 0x408b85
mov eax, esi
push eax
call fcn.0041b391
pop ecx
test eax, eax
je 0x408ba6
cmp dword [esi + 0x14], ebx
jb 0x408b99
mov eax, dword [esi]
jmp 0x408b9b
mov eax, esi
push eax
call fcn.0041b4bd
pop ecx
test eax, eax
jne 0x408be1
push str.AddIns
push 7
pop edi
mov eax, esi
call fcn.00403a31
cmp dword [esi + 0x14], ebx
jb 0x408bbe
mov eax, dword [esi]
jmp 0x408bc0
mov eax, esi
push eax
call fcn.0041b391
pop ecx
test eax, eax
je 0x408bed
cmp dword [esi + 0x14], ebx
jb 0x408bd4
mov eax, dword [esi]
jmp 0x408bd6
mov eax, esi
push eax
call fcn.0041b4bd
pop ecx
test eax, eax
je 0x408bed
xor eax, eax
mov ecx, 0x443268
call fcn.00401f96
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00419e3b
leave
ret

Function at 0x408bfe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax + 0x14], 8
jb 0x408c09
mov eax, dword [eax]
push esi
push 0x447530
push eax
call fcn.0041b5ad
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x408c51
cmp dword [edi + 0x14], 0x10
jb 0x408c27
mov eax, dword [edi]
jmp 0x408c29
mov eax, edi
add eax, dword [ebp + 8]
push esi
push 1
push dword [ebp + 0xc]
push eax
call fcn.0041b71b
add esp, 0x10
push esi
cmp eax, 1
je 0x408c4b
call fcn.0041b802
pop ecx
xor eax, eax
jmp 0x408c54
call fcn.0041b802
pop ecx
xor eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x40e12c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x40e162
cmp word [esi], bx
je 0x40e162
push ebx
push esi
call fcn.0041b8f5
pop ecx
pop ecx
test eax, eax
jne 0x40e162
cmp word [esi], bx
je 0x40e165
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e165
test al, 0x10
je 0x40e165
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x40e16b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x44e234]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
push ebx
push esi
push edi
push 9
xor eax, eax
mov ebx, ecx
pop ecx
push dword [ebp + 8]
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x4479dc
push eax
mov esi, edx
call fcn.0041aa7d
add esp, 0xc
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x40e223
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x40e223
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x40e223
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x40e223
mov ecx, dword [esi + 0x10]
inc eax
cmp eax, ecx
ja 0x40e1f9
or ecx, 0xffffffff
call fcn.00407fd3
jmp 0x40e205
push ebx
mov ebx, eax
sub ebx, ecx
mov edi, esi
call fcn.0040df87
or ecx, 0xffffffff
xor eax, eax
call fcn.00407fd3
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, esi
call fcn.00408222
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419e3b
leave
ret

Function at 0x40e235
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x44e234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x808], edi
call fcn.00401ca8
lea eax, [ebp - 0x808]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push edi
push eax
call fcn.0041be80
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
cmp dword [ebp - 0x808], edi
je 0x40e34f
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push str.TEMP
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e343
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40e2e3
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp - 0x804]
call fcn.00401f96
push 0xc
mov edi, str._SystemRoot_
push edi
xor eax, eax
mov ecx, esi
call fcn.00408f84
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e342
push 0x400
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40e342
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.0041db92
pop ecx
push eax
push ebx
push esi
call fcn.0040ca71
pop ebx
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00419e3b
leave
ret
Function at 0x40e35d
Capabilities:
Get common file path

Disassembly:
push 0x87c
mov eax, 0x43cf4c
call fcn.0041fdb5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x884], eax
xor eax, eax
xor ebx, ebx
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0x888], ebx
call fcn.0041be80
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea esi, [ebp - 0x848]
call fcn.00406ae4
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x834], 8
mov eax, dword [ebp - 0x848]
jae 0x40e3d3
mov eax, esi
mov ecx, dword [ebp - 0x838]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x40e3f6
xor edi, edi
push 0x447538
inc edi
lea eax, [ebp - 0x848]
call fcn.00403a31
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], ebx
mov word [ebp - 0x864], cx
mov dword [ebp - 0x818], eax
xor eax, eax
mov dword [ebp - 0x81c], ebx
mov word [ebp - 0x82c], ax
push 8
lea eax, [ebp - 0x864]
mov byte [ebp - 4], 2
call fcn.0040c3c4
lea ecx, [ebp - 0x848]
push ecx
lea ecx, [ebp - 0x880]
push ecx
mov ebx, eax
call fcn.0040e514
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x82c]
mov byte [ebp - 4], 3
call fcn.00403ac9
push 1
xor edi, edi
lea esi, [ebp - 0x880]
mov byte [ebp - 4], 2
call fcn.0040211c
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x40e485
lea eax, [ebp - 0x82c]
push 0
push eax
call fcn.0041b8f5
pop ecx
pop ecx
test eax, eax
jne 0x40e4b6
push 1
xor edi, edi
lea esi, [ebp - 0x82c]
call fcn.0040211c
push 1
lea esi, [ebp - 0x864]
call fcn.0040211c
xor ebx, ebx
jmp 0x40e3f6
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x40e4cb
lea eax, [ebp - 0x82c]
push eax
call fcn.0041b4bd
mov esi, dword [ebp - 0x884]
pop ecx
lea ebx, [ebp - 0x82c]
call fcn.00403b1c
push 1
xor edi, edi
mov esi, ebx
call fcn.0040211c
push 1
lea esi, [ebp - 0x864]
call fcn.0040211c
push 1
lea esi, [ebp - 0x848]
call fcn.0040211c
mov eax, dword [ebp - 0x884]
call fcn.0041fe38
ret
Function at 0x40ed91
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d14
call fcn.0042a830
mov eax, dword [0x44e234]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x5ec]
push str..PhysicalDrive_d
push eax
mov dword [ebp - 0x2d10], ebx
call fcn.0041aa7d
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0c], eax
cmp eax, 0xffffffff
je 0x40efe9
push edi
push 0xc
lea eax, [ebp - 0x2d08]
push ebx
push eax
mov dword [ebp - 0x2d14], ebx
call fcn.0041be80
mov edi, 0x2710
push edi
lea eax, [ebp - 0x2cfc]
push ebx
push eax
mov dword [ebp - 0x2d08], ebx
mov dword [ebp - 0x2d04], ebx
call fcn.0041be80
add esp, 0x18
push ebx
lea eax, [ebp - 0x2d14]
push eax
push edi
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push dword [ebp - 0x2d0c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40ef1c
push esi
push 0x3e7
lea eax, [ebp - 0x3eb]
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.0041be80
mov eax, dword [ebp - 0x2cf0]
push ebx
mov esi, 0x455d28
lea ecx, [ebp - 0x2cfc]
call fcn.0040ec48
mov eax, dword [ebp - 0x2cec]
push ebx
mov esi, 0x456128
lea ecx, [ebp - 0x2cfc]
call fcn.0040ec48
mov eax, dword [ebp - 0x2ce4]
push 1
lea esi, [ebp - 0x3ec]
lea ecx, [ebp - 0x2cfc]
call fcn.0040ec48
push 0x456128
push 0x455928
call fcn.0041d860
add esp, 0x20
pop esi
cmp byte [0x455528], bl
jne 0x40ef08
movzx eax, byte [ebp - 0x3ec]
push eax
call fcn.0041f13f
pop ecx
test eax, eax
jne 0x40eef3
movzx eax, byte [ebp - 0x3d9]
push eax
call fcn.0041f13f
pop ecx
test eax, eax
je 0x40ef08
lea eax, [ebp - 0x3ec]
push eax
push 0x455528
call fcn.0041d860
pop ecx
pop ecx
jmp 0x40ef22
cmp byte [0x455928], bl
je 0x40ef22
mov dword [ebp - 0x2d10], 1
jmp 0x40ef22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea eax, [ebp - 0x2cfc]
push ebx
push eax
call fcn.0041be80
add esp, 0xc
push ebx
lea eax, [ebp - 0x2d14]
push eax
push edi
lea eax, [ebp - 0x2cfc]
push eax
push ebx
push ebx
push 0x2d0c10
push dword [ebp - 0x2d0c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
test eax, eax
je 0x40efd7
xor eax, eax
push 0x3e6
mov word [ebp - 0x3ec], ax
lea eax, [ebp - 0x3ea]
push ebx
push eax
call fcn.0041be80
lea eax, [ebp - 0x2cec]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.0041d860
add esp, 0x14
cmp byte [0x455528], bl
jne 0x40efdd
movsx eax, byte [ebp - 0x3ec]
push eax
call fcn.0041f13f
pop ecx
test eax, eax
jne 0x40efb8
movsx eax, byte [ebp - 0x3d9]
push eax
call fcn.0041f13f
pop ecx
test eax, eax
je 0x40efdd
lea eax, [ebp - 0x3ec]
push eax
push 0x455528
call fcn.0041d860
pop ecx
pop ecx
mov dword [ebp - 0x2d10], 1
jmp 0x40efdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x2d0c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2d10]
xor ecx, ebp
pop ebx
call fcn.00419e3b
leave
ret
Function at 0x40fa43
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0042a830
mov eax, dword [0x44e234]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0040f890
mov dword [ebp - 0x1018], eax
xor eax, eax
mov esi, 0x7fe
push esi
mov word [ebp - 0x1008], ax
xor edi, edi
lea eax, [ebp - 0x1006]
push edi
push eax
call fcn.0041be80
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push edi
push eax
mov dword [ebp - 0x100c], edi
mov dword [ebp - 0x1010], edi
mov dword [ebp - 0x1014], edi
call fcn.0041be80
add esp, 0xc
mov eax, 0x400
push eax
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x1014]
push ecx
lea ecx, [ebp - 0x1010]
push ecx
lea ecx, [ebp - 0x100c]
push ecx
push eax
lea eax, [ebp - 0x1008]
push eax
push 0x447bd0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 0x1018]
mov ecx, dword [ebp - 0x100c]
mov edx, ebx
call fcn.0040f99c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00419e3b
leave
ret

Function at 0x40fb0c
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push 0x20
mov eax, 0x43b417
call fcn.0041fd7f
push dword [ebp + 8]
xor esi, esi
push esi
push 0x43a
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x40fb4a
mov dword [ebp - 0x1c], esi
push 0x4492f4
lea eax, [ebp - 0x1c]
push eax
call fcn.0041f219
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 4
push 0x1000
lea edi, [eax + eax + 2]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, esi
jne 0x40fb7f
mov dword [ebp - 0x20], esi
push 0x4492f4
lea eax, [ebp - 0x20]
jmp 0x40fb44
push esi
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40fb9f
mov dword [ebp - 0x24], esi
push 0x4492f4
lea eax, [ebp - 0x24]
jmp 0x40fb44
push 0x447bdc
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x40fbca
mov dword [ebp - 0x28], esi
push 0x4492f4
lea eax, [ebp - 0x28]
jmp 0x40fb44
push esi
push esi
push ebx
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, esi
jne 0x40fc1c
mov dword [ebp - 0x2c], esi
push 0x4492f4
lea eax, [ebp - 0x2c]
jmp 0x40fb44
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.0041fe24
ret 8
Function at 0x40fce4
Capabilities:
Enumerate gui resources

Disassembly:
push 0x2c
mov eax, 0x43d548
call fcn.0041fdb5
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x38], eax
cmp edi, ecx
je 0x40fd1b
mov ebx, ecx
sub ebx, ecx
sar ebx, 2
shl ebx, 2
push ebx
push ecx
push edi
call fcn.0041a0b0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x38]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
and dword [ebp - 4], eax
push str.XLMAIN
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], esi
call fcn.00402011
lea eax, [ebp - 0x34]
push eax
push 0x40fc37
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [esi + 4]
sub ebx, dword [esi]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
sar ebx, 2
call fcn.0040211c
mov eax, ebx
call fcn.0041fe38
ret

Function at 0x412860
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x41286b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.00412880
Function at 0x415fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x415fd3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x41604d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0041bf10
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x416021
sub eax, edi
jmp 0x416023
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x416012
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x416040
sub eax, edi
jmp 0x416042
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x416031
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x416102
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x416073
mov ebx, ecx
test ebx, ebx
je 0x4160c6
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x416095
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.004141c0
jmp 0x4160ae
cmp eax, 2
jne 0x4160b4
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x4160a7
xor eax, eax
jmp 0x4160b1
mov edx, ebx
call fcn.00412880
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.0041bf10
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4160ee
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x416102
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x415fd0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418448
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4540e0], 0
push esi
push edi
jne 0x4183be
call fcn.0041832a
test eax, eax
je 0x418403
mov eax, dword [0x4540e0]
cmp eax, 1
jne 0x4183df
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x418403
jmp 0x418445
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x418445
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x418407
xor eax, eax
jmp 0x418445
mov eax, dword [esi]
push dword [0x4540e0]
call edi
mov edi, eax
test edi, edi
je 0x418429
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x418445
lea edi, [esi + 0xff0]
push esi
push dword [0x4540e0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41842f
mov eax, esi
pop edi
pop esi
ret
jmp 0x4183aa

Function at 0x419e3b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e234]
jne 0x419e45
repz ret
jmp fcn.004212f9

Function at 0x41b876
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41b89d
call fcn.0041f8de
mov dword [eax], esi
call fcn.0041f8cb
push 0x16
pop esi
mov dword [eax], esi
call fcn.004227f4
mov eax, esi
jmp 0x41b8f2
test dword [ebp + 0xc], 0xfffffff9
jne 0x41b883
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41b8ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041f8f1
pop ecx
call fcn.0041f8cb
mov eax, dword [eax]
jmp 0x41b8f2
test al, 0x10
jne 0x41b8f0
test al, 1
je 0x41b8f0
test byte [ebp + 0xc], 2
je 0x41b8f0
call fcn.0041f8de
mov dword [eax], 5
call fcn.0041f8cb
mov dword [eax], 0xd
jmp 0x41b8c1
xor eax, eax
pop esi
pop ebp
ret