joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
je 0x402b37
xor ecx, ecx
cmp cx, word [eax]
je 0x402b37
cmp dword [esi + 0x20], ecx
je 0x402abb
mov eax, 0xb7
pop esi
pop ebp
ret 8
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0xa0
push edi
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x402af6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ebx, eax
mov dword [esi + 0x20], 0
pop ebx
pop esi
pop ebp
ret 8
cmp edi, 3
jne 0x402b11
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8
cmp edi, 2
jne 0x402b2e
push 0
lea ecx, [ebp + 0xc]
mov word [ebp + 8], 0xfeff
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8
mov eax, 0x57
pop esi
pop ebp
ret 8

Function at 0x403770
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov eax, dword [ebx + 0x438]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
test eax, eax
je 0x4037a2
push 0x1b58
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x458]
mov ecx, ebx
mov edi, 0x57
call eax
test al, al
je 0x40386f
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x40386f
xor ecx, ecx
cmp cx, word [eax]
je 0x40386f
mov ecx, ebx
call fcn.00402c00
mov edi, eax
test edi, edi
je 0x4037e8
cmp edi, 0xb7
jne 0x40386f
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403060
mov esi, dword [esp + 0xc]
mov edi, eax
test edi, edi
jne 0x40386f
test esi, esi
jne 0x40381b
lea edi, [eax + 0xe]
jmp 0x40386f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403820
sub ecx, edx
lea eax, [esp + 0x14]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push esi
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test byte [ebx + 0x448], 1
mov dword [esp + 0x10], eax
je 0x403863
xor ecx, ecx
cmp cx, word [esi]
je 0x403863
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40386f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x403884
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x20], 0
test esi, esi
je 0x403891
push esi
call fcn.004353e2
add esp, 4
mov eax, dword [ebx + 0x438]
test eax, eax
je 0x4038a2
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403c20
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x46b0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x403d1e
xor eax, eax
cmp ax, word [esi]
je 0x403d1e
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403c50
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x403d1e
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x462950
push esi
push 0x462a40
push 0x104
push eax
call fcn.00403b90
add esp, 0x14
lea ecx, [ebp - 0x210]
mov edx, edi
call fcn.004044e0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x403d0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x403cdb
cmp eax, 0x91
jne 0x403d0c
push ecx
mov ecx, esi
call fcn.004043a0
add esp, 4
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x403d0a
test eax, eax
je 0x403d0a
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042d012
mov esp, ebp
pop ebp
ret
Function at 0x4043a0
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x46b0b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x110
xor edi, edi
lea eax, [ebp - 0x328]
push edi
push eax
mov esi, ecx
call fcn.0042fef0
add esp, 0xc
mov dword [ebp - 0x32c], 0x114
test esi, esi
je 0x4044c2
xor eax, eax
cmp ax, word [esi]
je 0x4044c2
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x404411
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov ecx, esi
cmp dword [ebp - 0x31c], 2
sete bl
call fcn.00403d30
test eax, eax
jne 0x40443a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test ebx, ebx
je 0x40446a
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4044af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov edi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edx, 0x46295c
lea ecx, [ebp - 0x214]
call fcn.004042e0
test eax, eax
jne 0x4044af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 0x57
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d012
mov esp, ebp
pop ebp
ret
Function at 0x4044e0
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x46c
mov eax, dword [0x46b0b4]
xor eax, esp
mov dword [esp + 0x468], eax
push ebx
push esi
push edi
push 0x250
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], edx
push 0
push eax
mov edi, ecx
call fcn.0042fef0
add esp, 0xc
lea eax, [esp + 0x268]
push 0x208
push 0
push eax
call fcn.0042fef0
add esp, 0xc
test edi, edi
je 0x4046d6
xor eax, eax
cmp ax, word [edi]
je 0x4046d6
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404546
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4046d6
lea ecx, [esp + 0x268]
mov esi, edi
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40458e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40458e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x404570
lea eax, [ecx - 2]
test edx, edx
push 0x5c
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x26c]
push eax
call fcn.0042f5ae
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4046d6
lea eax, [esp + 0x18]
add ebx, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4046d6
lea ecx, [esp + 0x268]
mov eax, ebx
sub eax, ecx
mov esi, 1
sar eax, 1
mov ecx, 0x104
sub ecx, eax
mov dword [esp + 0x14], ecx
nop
lea eax, [esp + 0x44]
push eax
push ecx
push ebx
call fcn.00403e20
test byte [esp + 0x18], 0x10
je 0x40462f
mov eax, 0x2e
cmp ax, word [esp + 0x44]
je 0x40469c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40469c
mov edx, eax
lea ecx, [esp + 0x268]
call fcn.00403c20
jmp 0x40468b
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40469c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf
je 0x40469c
cmp eax, 2
je 0x40469c
cmp eax, 3
je 0x40469c
push ecx
lea ecx, [esp + 0x26c]
call fcn.004043a0
add esp, 4
neg eax
sbb eax, eax
inc eax
test esi, esi
je 0x40469a
test eax, eax
je 0x40469a
mov esi, 1
jmp 0x40469c
xor esi, esi
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x4045f0
test edi, edi
je 0x4046bf
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x474]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
Function at 0x4046f0
Capabilities:
Create directory

Disassembly:
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x404767
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404700
sub edx, ecx
sar edx, 1
cmp edx, 3
jbe 0x404767
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404720
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x404748
mov ecx, esi
call fcn.00403b00
test eax, eax
jne 0x404748
xor edx, edx
mov ecx, esi
call fcn.004044e0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404762
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40476c
xor eax, eax
pop esi
pop ecx
ret
mov eax, 0x57
pop esi
pop ecx
ret

Function at 0x404770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46b0b4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4047ba
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4047ba
test al, 0x10
je 0x4047ba
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
push 0x5c
push edi
call fcn.0042f8b3
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4047a3
push 0x5c
push edi
call fcn.0042f5ae
mov esi, eax
add esp, 8
test esi, esi
je 0x4047a3
cmp ebx, esi
je 0x40483b
push 0x208
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0042fef0
sub esi, edi
add esp, 0xc
sar esi, 1
cmp esi, 0x7ffffffe
jbe 0x404809
xor eax, eax
mov word [esp + 0x10], ax
jmp 0x40481a
push esi
push edi
push ecx
mov edx, 0x104
lea ecx, [esp + 0x1c]
call fcn.00403dd0
add esi, esi
cmp esi, 0x208
jae 0x40485b
xor eax, eax
lea ecx, [esp + 0x10]
mov word [esp + esi + 0x10], ax
lea edx, [eax + 1]
call fcn.00404770
test eax, eax
jne 0x404846
push ecx
mov ecx, edi
call fcn.004046f0
add esp, 4
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
call fcn.0042d675
int3
Function at 0x404870
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x46b0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x4049fd
cmp word [esi], 0
je 0x4049fd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4048bc
test al, 0x10
je 0x4048bc
mov eax, 0xb7
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0042fef0
push 0x5c
push esi
call fcn.0042f8b3
add esp, 0x14
test eax, eax
je 0x404960
cmp eax, esi
jne 0x404959
movzx eax, word [ebp - 0x414]
mov word [ebp - 0x20c], ax
movzx eax, word [ebp - 0x412]
push esi
mov word [ebp - 0x20a], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00403a80
lea ecx, [ebp - 0x20c]
call fcn.00404770
neg eax
pop esi
sbb eax, eax
and eax, 0x52
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
cmp word [esi + 2], 0x3a
je 0x4049a2
push esi
lea eax, [ebp - 0x414]
push eax
push 0x462a40
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00403b90
add esp, 0x14
lea ecx, [ebp - 0x20c]
call fcn.00404770
neg eax
pop esi
sbb eax, eax
and eax, 0x52
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20c]
mov edx, 0x104
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4049cf
movzx eax, word [esi + ecx]
test ax, ax
je 0x4049cf
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4049b1
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x20c]
call fcn.00404770
neg eax
pop esi
sbb eax, eax
and eax, 0x52
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
xor ecx, ebp
pop esi
call fcn.0042d012
mov esp, ebp
pop ebp
ret
Function at 0x404c40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46b0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x404c6a
xor ecx, ecx
cmp cx, word [eax]
je 0x404e9b
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404e9b
xor ecx, ecx
cmp cx, word [eax]
je 0x404e9b
push 0x208
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x404e9b
push str.McAfee_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00436370
add esp, 0xc
lea eax, [ebp - 0x210]
push str.MCLOGS
push 0x104
push eax
call fcn.00436370
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x462a2c
push 0x104
push eax
call fcn.00436370
mov ecx, dword [esi + 8]
add esp, 0xc
xor edi, edi
test ecx, ecx
je 0x404d22
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d10
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 1]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d30
sub ecx, edx
mov edx, dword [esi + 0xc]
sar ecx, 1
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404d45
sub edx, ebx
lea eax, [ecx + 1]
sar edx, 1
add eax, edx
add edi, eax
lea ebx, [edi + edi]
push ebx
call fcn.00435775
add esp, 4
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x404d84
mov eax, 0xe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
push ebx
push 0
push eax
call fcn.0042fef0
mov eax, dword [esi + 8]
add esp, 0xc
push dword [esi + 0xc]
test eax, eax
je 0x404db5
push eax
lea eax, [ebp - 0x210]
push eax
push 0x462a30
push edi
push dword [esi + 0x1c]
call fcn.00404c20
add esp, 0x18
jmp 0x404dcd
lea eax, [ebp - 0x210]
push eax
push str._s_s
push edi
push dword [esi + 0x1c]
call fcn.00404c20
add esp, 0x14
mov ecx, dword [esi + 0x1c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404dd3
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 9]
lea ebx, [edi + edi]
push ebx
call fcn.00435775
add esp, 4
mov dword [esi + 0x450], eax
test eax, eax
je 0x404d6e
push ebx
push 0
push eax
call fcn.0042fef0
add esp, 0xc
push str.log.ini
push dword [esi + 0x1c]
push 0x462a40
push edi
push dword [esi + 0x450]
call fcn.00404c20
lea ecx, [ebp - 0x210]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404e30
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 8]
lea ebx, [edi + edi]
push ebx
call fcn.00435775
add esp, 4
mov dword [esi + 0x44c], eax
test eax, eax
je 0x404d6e
push ebx
push 0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x210]
push str.log.ini
push eax
push str._s_s
push edi
push dword [esi + 0x44c]
call fcn.00404c20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d012
mov esp, ebp
pop ebp
ret
Function at 0x4057a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
je 0x40586e
cmp dword [ebp + 0xc], 1
jl 0x40586e
push esi
push edi
xor eax, eax
nop
mov byte [ebx + eax + 1], al
inc eax
cmp eax, 0x100
jl 0x4057c0
mov esi, dword [ebp + 8]
lea edi, [ebx + 1]
mov word [ebx + 0x201], 0
mov dword [ebp - 4], 0x100
movzx eax, byte [ebx + 0x201]
mov dword [ebx + 0x204], edi
movzx eax, byte [eax + esi]
add al, byte [edi]
add byte [ebx + 0x202], al
movzx eax, byte [ebx + 0x202]
inc eax
add eax, ebx
mov dword [ebx + 0x208], eax
movzx eax, byte [edi]
mov byte [ebx + 0x20c], al
mov eax, dword [ebx + 0x208]
movzx eax, byte [eax]
mov byte [edi], al
inc edi
mov ecx, dword [ebx + 0x208]
movzx eax, byte [ebx + 0x20c]
mov byte [ecx], al
movzx eax, byte [ebx + 0x201]
inc eax
cdq
idiv dword [ebp + 0xc]
sub dword [ebp - 4], 1
mov byte [ebx + 0x201], dl
jne 0x4057e2
lea edi, [ebx + 0x101]
mov word [ebx + 0x201], 0
lea esi, [ebx + 1]
mov byte [ebx], 1
mov ecx, 0x40
mov al, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
test edx, edx
je 0x405b09
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405b09
mov ecx, dword [ebp + 0x10]
cmp ecx, 1
jb 0x405b09
test ecx, ecx
je 0x405aff
sub edx, eax
push ebx
mov dword [ebp + 8], edx
push edi
nop
mov al, byte [edx + eax]
mov ecx, esi
xor byte [esi + 0x221], al
call fcn.004059e0
mov bh, al
mov ecx, esi
xor bh, byte [esi + 0x221]
call fcn.004059e0
mov bl, al
mov edi, 1
add bl, bh
cmp dword [esi + 0x210], edi
jle 0x405aeb
mov ecx, esi
call fcn.004059e0
mov ecx, esi
xor bl, al
call fcn.004059e0
inc edi
add bl, al
cmp edi, dword [esi + 0x210]
jl 0x405ad0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov byte [eax], bl
inc eax
sub dword [ebp + 0x10], 1
mov dword [ebp + 0xc], eax
jne 0x405aa0
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x405b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x406460
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x46b0b4]
xor eax, esp
mov dword [esp + 0x70], eax
push esi
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x4064e8
cmp edx, 1
jb 0x4064e8
test esi, esi
je 0x4064e8
push edx
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00405b50
lea eax, [esp + 0x14]
push eax
call fcn.00406350
movups xmm0, xmmword [esp + 0x70]
add esp, 0x10
xor eax, eax
movups xmmword [esi], xmm0
pop esi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x74]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.0042d012
mov esp, ebp
pop ebp
ret

Function at 0x406a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x44c]
test eax, eax
je 0x406a26
xor ecx, ecx
cmp cx, word [eax]
je 0x406a26
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406a4f
mov eax, dword [esi + 0x450]
test eax, eax
je 0x406af2
xor ecx, ecx
cmp cx, word [eax]
je 0x406af2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406af2
lea eax, [ebp - 4]
push eax
push 1
push str.Enable
push ecx
mov ecx, esi
call fcn.004068d0
test eax, eax
jne 0x406a6f
mov eax, dword [ebp - 4]
mov dword [esi + 0x454], eax
lea eax, [ebp - 8]
push eax
push 0x25800
push str.MaxSize
push ecx
mov ecx, esi
call fcn.004068d0
test eax, eax
jne 0x406a92
mov eax, dword [ebp - 8]
mov dword [esi + 0x43c], eax
lea eax, [ebp - 0xc]
push eax
push 3
push str.MaxEntries
push ecx
mov ecx, esi
call fcn.004068d0
test eax, eax
jne 0x406ab2
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x440], eax
lea eax, [ebp - 0x10]
push eax
push 3
push str.Severity
push ecx
mov ecx, esi
call fcn.004068d0
test eax, eax
jne 0x406ad2
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x444], eax
lea eax, [ebp - 0x14]
push eax
push 0x10
push str.Options
push ecx
mov ecx, esi
call fcn.004068d0
test eax, eax
jne 0x406af2
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x448], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fbe7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40fc4c
xor eax, eax
cmp ax, word [esi]
je 0x40fc4c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40fc08
push 2
jmp 0x40fc4e
push 0
call fcn.0040fa2f
pop ecx
push esi
mov ecx, eax
call fcn.00412cc2
test eax, eax
je 0x40fc4f
push 0x46cc10
push dword [0x455508]
push section..data
push 0x46b01c
push dword [0x45550c]
push esi
call fcn.00411559
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
jmp 0x40fc4f
push 0x57
pop eax
pop esi
pop ebp
ret

Function at 0x411a85
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push 0x41202e
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x411ac7
push esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
jmp 0x411ac9
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret