joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5099b0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov edi, eax
mov eax, edi
call fcn.00484a08
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp], eax
cmp dword [esp], 0
jne 0x5099f2
mov eax, edi
mov edx, 0x509a2c
call fcn.00484a5c
jmp 0x509a1a
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x509a0f
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00489930
inc ebx
mov eax, dword [esp + 4]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x509a00
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x51d494
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51d4c2
mov eax, ebx
call fcn.0051df48
cmp dword [ebx + 0x40], 0
je 0x51d4bb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51d533
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51d525
cmp dword [ebx + 8], 0
je 0x51d4e4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51d4f6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51d525
cmp dword [ebx + 8], 0
je 0x51d4d7
cmp eax, 3
je 0x51d509
dec eax
jne 0x51d4d7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51d4d7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51d4d7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x51d551
cmp dword [ebx + 0x14], 0xcc
je 0x51d551
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0051d55c
pop ebx
ret

Function at 0x534310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00484ec8
xor eax, eax
push ebp
push 0x534361
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00484ed8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x534345
test al, 0x10
jne 0x534349
xor ebx, ebx
jmp 0x53434b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534368
lea eax, [ebp - 4]
call fcn.00484a08
ret

Function at 0x537518
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
dec ecx
test ecx, ecx
jb 0x537542
inc ecx
movzx esi, byte [edx]
mov ebx, dword [eax]
mov edi, ebx
and edi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x54bd3c]
shr ebx, 8
xor esi, ebx
mov dword [eax], esi
inc edx
dec ecx
jne 0x537521
pop edi
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4981a7]
shl eax, 2
mov dword [0x4981ab], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0048cf9c
pop edx
call fcn.0048c2a4
call fcn.0048cfa0
push 0
call fcn.0048e2a4
pop ecx
push 0x498150
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4981af], eax
push 0
jmp fcn.00494fc8
Function at 0x406740
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x406760
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x406747
cmp dword [eax], 0x11
jbe 0x40677b
mov dword [eax], 0x11
jmp 0x40676f
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x40677b
cmp dword [eax + edx*4], 0
je 0x40676d
ret

Function at 0x406fb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x406ffb
mov eax, 1
jmp 0x406fd4
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x406fca
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.0048d234
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x407060
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x407039
mov eax, 1
jmp 0x407012
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x407008
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.0048d234
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x407060
mov eax, dword [ebx]
test eax, eax
jbe 0x40704c
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x40704c
dec eax
test eax, eax
ja 0x40703f
mov dword [edi], eax
test eax, eax
jbe 0x407060
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x407052
pop edi
pop esi
pop ebx
ret
Function at 0x40882c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff790
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x35], dl
mov ebx, eax
mov eax, 0x498c70
call fcn.0048d8c4
cmp byte [ebx + 0x6e05], 0
mov eax, dword [ebx + 0x13cc]
je 0x40886a
cmp byte [eax + 0x20e1], 0
jne 0x40886a
cmp byte [ebx + 0x6e00], 0
je 0x40887b
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
mov eax, edx
jmp 0x408a0f
mov word [ebp - 0x24], 8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040e5f0
inc dword [ebp - 0x18]
xor edx, edx
mov word [ebp - 0x24], 0x14
movzx eax, word [ebx + 0x46e4]
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebx + 0x46e8]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.00409820
mov eax, ebx
call fcn.00405014
cmp byte [ebp - 0x35], 0
je 0x4088f8
push pe_nt_image_headers32
lea edx, [ebp - 0x238]
push edx
push dword [0x4b9824]
call sub.USER32.DLL_GetWindowTextA
mov eax, 0x34a
call fcn.004117b8
call fcn.004775b4
call fcn.00476b3c
mov edx, dword [ebx + 0x46c0]
sub edx, 0x76
je 0x408910
sub edx, 3
je 0x40894a
dec edx
je 0x40895c
jmp 0x408995
test byte [ebx + 0x46dc], 0x20
jne 0x408938
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040e65c
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
jmp 0x408a0f
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00408138
jmp 0x408995
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00408a18
jmp 0x408995
push 0x498b64
lea eax, [ebx + 0x5448]
push eax
call fcn.0048d3d8
add esp, 8
test eax, eax
sete dl
and edx, 1
test dl, dl
je 0x40898e
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00408c70
jmp 0x408995
mov byte [ebp - 0x23a], 1
cmp byte [ebp - 0x35], 0
je 0x4089ab
lea eax, [ebp - 0x238]
call fcn.004775b4
call fcn.00476b3c
test esi, esi
je 0x4089c0
push esi
mov edi, esi
lea esi, [ebp - 0x870]
mov ecx, 0x18e
rep movsd dword es:[edi], dword [esi]
pop esi
cmp byte [ebp - 0x23a], 0
je 0x4089f5
cmp byte [ebp - 0x35], 0
je 0x4089f5
mov eax, 0x2a9
call fcn.004117b8
push eax
add ebx, 0x17
push ebx
call fcn.00444944
add esp, 8
mov eax, 0x4a697c
mov edx, 1
call fcn.004298f4
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040e65c
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x409153
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x409164
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x409173
or dword [ebp - 8], 2
cmp byte [ebx + 0x15], 0
je 0x40917d
xor eax, eax
jmp 0x409182
mov eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.0040f8f0
test eax, eax
je 0x4091af
test esi, esi
je 0x4091af
cmp word [esi], 0
je 0x4091af
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x4091c6
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4091df
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4091df
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40924d
mov dword [ebx + 4], edi
test esi, esi
je 0x409214
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0040f9f8
jmp 0x40921d
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x409234
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.0048d424
add esp, 8
jmp 0x409243
lea edx, [ebx + 0x17]
mov ecx, 0x10000000
mov eax, esi
call fcn.0040f944
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00409364
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4094fc
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x4096b4
mov eax, dword [edi + 0xc]
test eax, eax
je 0x409537
dec eax
je 0x409521
dec eax
je 0x40952d
jmp 0x409537
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x409537
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x409589
xor ebp, ebp
cmp esi, ebp
jle 0x4095a5
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40955c
mov ecx, esi
sub ecx, ebp
jmp 0x409561
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x4095a5
add ebp, 0x4000
cmp esi, ebp
jg 0x409543
jmp 0x4095a5
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x4096b0
cmp byte [edi + 0x14], 0
je 0x4096b0
cmp dword [edi + 0xc], 0
jne 0x4096b0
call sub.KERNEL32.DLL_GetLastError
mov ebp, eax
mov eax, edi
call fcn.004098d8
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [edi + 0x17]
call fcn.00409fbc
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push ebp
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
cdq
cmp edx, dword [esp + 0x14]
jne 0x4095fe
cmp eax, dword [esp + 0x10]
jae 0x40964a
jmp 0x409600
jge 0x40964a
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x409622
cmp eax, 0xffffffff
ja 0x40964a
jmp 0x409624
jg 0x40964a
mov eax, esi
cdq
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
cmp edx, 0
jne 0x40963b
cmp eax, 0xffffffff
jbe 0x40964a
jmp 0x40963d
jle 0x40964a
lea edx, [edi + 0x17]
mov eax, 0x4a697c
call fcn.00429698
lea edx, [edi + 0x17]
mov eax, 0x4a697c
call fcn.004296cc
test al, al
je 0x40969a
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x409537
cmp dword [esp + 4], 0
jbe 0x409537
mov eax, edi
call fcn.004098d8
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.00409820
jmp 0x409537
lea ecx, [edi + 0x17]
mov eax, 0x4a697c
xor edx, edx
call fcn.00429680
jmp 0x4096b0
mov byte [edi + 8], 1
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4097a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x4097c7
cmp esi, 0x4e20
jle 0x4097bd
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x409818
mov eax, ebx
call fcn.00409b44
test al, al
je 0x4097ff
cmp esi, 0x4e20
jle 0x4097ff
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.004097a0
jmp 0x40981b
cmp dword [ebx + 0xc], 1
jne 0x409813
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x409813
xor eax, eax
jmp 0x40981b
or eax, 0xffffffff
jmp 0x40981b
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409c4c
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040f8f0
test eax, eax
je 0x409c72
test ebx, ebx
je 0x409c72
cmp word [ebx], 0
je 0x409c72
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x409c7a
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x409c8d
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.0040a540
xor eax, eax
jmp 0x409ca8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x409c9c
cmp eax, 3
jne 0x409ca3
mov eax, 2
jmp 0x409ca8
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x409f80
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffc00
mov edx, esp
call fcn.0040bfdc
cmp byte [esp], 0
je 0x409f97
mov eax, esp
jmp 0x409f99
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x409fad
cmp eax, 5
je 0x409fad
xor edx, edx
jmp 0x409fb2
mov edx, 1
mov eax, edx
add esp, 0x400
ret
Function at 0x409fbc
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xfffffbd0
mov ebx, eax
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040bfdc
cmp dword [0x498d7c], 0
jne 0x409ffa
push 0x498d80
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x409ffa
push 0x498d8d
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x498d7c], eax
cmp dword [0x498d7c], 0
je 0x40a069
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0040bac0
xor ecx, ecx
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
push eax
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x18]
push eax
cmp byte [esp + 0x3c], 0
je 0x40a034
lea edx, [esp + 0x3c]
jmp 0x40a036
xor edx, edx
push edx
call dword [0x498d7c]
test eax, eax
je 0x40a069
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
ja 0x40a069
mov eax, dword [esp + 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x40a0d6
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push ecx
cmp byte [esp + 0x40], 0
je 0x40a08a
lea eax, [esp + 0x40]
jmp 0x40a08c
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x40a09f
mov eax, 0x163e00
xor edx, edx
jmp 0x40a0d6
mov eax, dword [esp + 0x18]
imul dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.0049189c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x430
pop esi
pop ebx
ret

Function at 0x40a0e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040f8f0
test eax, eax
je 0x40a10b
test ebx, ebx
je 0x40a10b
cmp word [ebx], 0
je 0x40a10b
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x40a514
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040f8f0
test eax, eax
je 0x40a536
test ebx, ebx
je 0x40a536
cmp word [ebx], 0
je 0x40a536
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x40a540
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040f8f0
test eax, eax
je 0x40a56d
test ebx, ebx
je 0x40a56d
cmp word [ebx], 0
je 0x40a56d
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x40a57c
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x40a6c4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9b0
push ebx
push esi
push edi
mov edi, eax
mov eax, 0x498e90
call fcn.0048d8c4
mov word [ebp - 0x30], 8
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040e5f0
inc dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov edx, 0x10000
call fcn.0040289c
inc dword [ebp - 0x24]
or esi, 0xffffffff
mov word [ebp - 0x30], 0x14
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
cmp dword [0x4b9824], 0
je 0x40a74d
lea eax, [ebp - 0x250]
call fcn.004775dc
push pe_nt_image_headers32
lea edx, [ebp - 0x450]
push edx
push dword [0x4b9824]
call sub.USER32.DLL_GetWindowTextA
mov eax, edi
call fcn.00409ad8
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push 0
push 0
xor edx, edx
mov eax, edi
call fcn.00409820
jmp 0x40a80a
add dword [ebp - 0x48], 1
adc dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
and eax, 0xf
xor edx, edx
cmp edx, 0
jne 0x40a7e4
cmp eax, 0
jne 0x40a7e4
cmp dword [0x4b9824], 0
je 0x40a7df
push 0
push 0x10000
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
call fcn.0049189c
push edx
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0040e4d0
push eax
mov eax, 0x51e
call fcn.004117b8
push eax
lea edx, [ebp - 0x650]
push edx
call fcn.004902f4
add esp, 0xc
lea eax, [ebp - 0x650]
call fcn.004775ec
call fcn.00476b3c
call fcn.0040f420
mov ecx, ebx
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040ff30
cmp dword [ebp + 0xc], 0x80000000
mov esi, eax
jne 0x40a7ff
cmp dword [ebp + 8], 0
je 0x40a80a
mov eax, ebx
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0x80000000
jne 0x40a820
cmp dword [ebp + 8], 0
jne 0x40a820
mov ecx, 0x10000
jmp 0x40a83f
cmp dword [ebp + 0xc], 0
jne 0x40a831
cmp dword [ebp + 8], 0x10000
jbe 0x40a83a
jmp 0x40a833
jle 0x40a83a
mov ecx, 0x10000
jmp 0x40a83f
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, edi
call fcn.004096bc
mov ebx, eax
test eax, eax
jne 0x40a76c
cmp dword [0x4b9824], 0
je 0x40a877
lea eax, [ebp - 0x250]
call fcn.004775ec
lea eax, [ebp - 0x450]
call fcn.004775b4
call fcn.00476b3c
mov eax, esi
mov edx, 2
xor eax, 0xffffffff
push eax
lea eax, [ebp - 0x1c]
dec dword [ebp - 0x24]
call fcn.0040177c
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040e65c
pop eax
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b13c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40b145
mov eax, dword [ebp - 4]
add esp, 0xfffffb0c
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x20f8]
mov eax, 0x498fb4
call fcn.0048d8c4
lea eax, [ebp - 0x10e4]
call fcn.00412ecc
lea eax, [ebp - 0x10b8]
call fcn.00412ecc
lea eax, [ebp - 0x108c]
call fcn.00412ecc
push 0
lea ecx, [ebp - 0x1cf8]
mov edx, ebx
mov eax, esi
call fcn.00411fe4
test al, al
jne 0x40b1b9
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40b36e
cmp byte [ebp - 0x1cf8], 0
je 0x40b1cb
cmp byte [ebp - 0x1060], 0
jne 0x40b1df
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40b36e
lea eax, [ebp - 0x1cf8]
call fcn.0040b590
lea edx, [ebp - 0x1060]
call fcn.0040e6f4
test eax, eax
je 0x40b20f
mov eax, esi
call fcn.0040b590
lea edx, [ebp - 0x1060]
call fcn.0040e6f4
test eax, eax
je 0x40b223
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40b36e
xor ebx, ebx
push 0x400
push esi
push edi
call fcn.0048d674
add esp, 0xc
push ebx
push 0x498f8b
mov eax, edi
call fcn.0040b590
push eax
call fcn.004902f4
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.0040a0e0
test al, al
je 0x40b262
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40b225
mov eax, edi
xor edx, edx
call fcn.0040a0e0
test al, al
je 0x40b283
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40b36e
push 0x400
push esi
lea ecx, [ebp - 0x24f8]
push ecx
call fcn.0048d674
add esp, 0xc
lea eax, [ebp - 0x1cf8]
call fcn.0040b590
push eax
lea eax, [ebp - 0x24f8]
call fcn.0040b590
push eax
call fcn.0048d424
add esp, 8
push edi
lea edx, [ebp - 0x24f8]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40b2dd
xor eax, eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
jmp 0x40b36e
mov word [ebp - 0xc34], 8
lea eax, [ebp - 0xc20]
call fcn.00409038
inc dword [ebp - 0xc28]
mov word [ebp - 0xc34], 0x14
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.0040a0e0
test al, al
jne 0x40b320
lea eax, [ebp - 0xc20]
xor ecx, ecx
mov edx, esi
call fcn.004092b0
mov ebx, eax
lea eax, [ebp - 0x24f8]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40b347
lea eax, [ebp - 0xc20]
call fcn.004093e4
lea eax, [ebp - 0xc20]
call fcn.00409478
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xc20]
dec dword [ebp - 0xc28]
call fcn.004090e8
pop eax
mov edx, dword [ebp - 0xc44]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f420
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x4997a4], 0
jne 0x40f439
call fcn.004957b8
mov dword [0x4997a0], eax
inc byte [0x4997a4]
call fcn.004957b8
sub eax, dword [0x4997a0]
cmp eax, 0x64
jle 0x40f475
cmp dword [0x4bc1ac], 0
je 0x40f470
mov eax, 0x4a697c
mov edx, 0xff
call fcn.004298f4
mov eax, 0x4a697c
mov edx, 0xff
call fcn.004298dc
call fcn.00444324
mov eax, dword [0x49979c]
test eax, eax
je 0x40f484
push eax
call sub.KERNEL32.DLL_Sleep
ret
Function at 0x40f894
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x40f8e0
lea eax, [esp + 8]
push eax
push 0x4997c6
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push 0x80000000
push 0xd
call sub.USER32.DLL_ExitWindowsEx
add esp, 0x14
ret

Function at 0x40ff30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x4a88cc
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x40ff4a
call fcn.0040fef8
mov eax, ebp
jmp 0x40ff62
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x40ff6a
test al, 7
jne 0x40ff4e
cmp esi, 8
jb 0x40fff3
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x40ff73
xor edx, edx
jmp 0x41000d
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x40fff7
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret