joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4136f0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x445858
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x459178]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [0x459178]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41372c
mov eax, dword [esi]
jmp 0x41372e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x413740
mov al, 1
jmp 0x4137cd
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004142f0
test al, al
je 0x413797
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x413797
mov bl, 1
jmp 0x413799
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4137b4
push dword [esp + 0xc]
call fcn.004368cb
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00435a0a
add esp, 0x28
ret

Function at 0x4137f0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x445858
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x459178]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [0x459178]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41382c
mov eax, dword [esi]
jmp 0x41382e
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x413842
mov al, 1
jmp 0x4138d1
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004142f0
test al, al
je 0x41389b
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41389b
mov bl, 1
jmp 0x41389d
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4138b8
push dword [esp + 0xc]
call fcn.004368cb
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00435a0a
add esp, 0x28
ret
Function at 0x413ba0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x44595b
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x459178]
xor eax, esp
mov dword [esp + 0x624], eax
push esi
mov eax, dword [0x459178]
xor eax, esp
push eax
lea eax, [esp + 0x630]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x45dd20]
mov dword [esp + 8], 0x45dd20
test eax, eax
je 0x413bf2
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x638], 0
cmp dword [0x45a2a0], 0
je 0x413c40
cmp esi, 0x45a290
je 0x413c1e
push 0xffffffffffffffff
push 0
push 0x45a290
mov ecx, esi
call fcn.00401a6e
mov dword [esp + 0x638], 0xffffffff
mov eax, dword [0x45dd20]
test eax, eax
je 0x413c39
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x413d1b
xor eax, eax
push 0x20a
push eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push eax
call fcn.00436b80
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x413cfe
xor eax, eax
push 0x410
push eax
mov word [esp + 0x21e], ax
mov word [esp + 0x220], ax
lea eax, [esp + 0x222]
push eax
call fcn.00436b80
add esp, 0xc
lea eax, [esp + 0x218]
push 0x208
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x413ced
test eax, eax
je 0x413ced
add eax, eax
cmp eax, 0x412
jae 0x413ce8
xor ecx, ecx
mov word [esp + eax + 0x218], cx
lea eax, [esp + 0x218]
push eax
mov ecx, esi
call fcn.004016c8
jmp 0x413c1e
call fcn.00436a08
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.004016c8
jmp 0x413c1e
mov dword [esp + 0x638], 0xffffffff
mov eax, dword [0x45dd20]
test eax, eax
je 0x413d19
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x630]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.00435a0a
add esp, 0x634
ret

Function at 0x414f40
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x459178]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x414f6e
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 4
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x414fa9
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 4
Function at 0x415080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x24
xor eax, eax
push ebx
push ebp
push esi
push edi
lea esp, [esp]
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x461180], ecx
inc eax
cmp eax, 0x100
jb 0x415090
cmp eax, 0x800
jae 0x415163
lea esp, [esp]
mov edx, dword [eax*4 + 0x460d80]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x461180]
mov dword [eax*4 + 0x461180], edx
inc eax
cmp eax, 0x800
jb 0x415140
lea ecx, [esp + 0x10]
mov dword [0x45de34], 0x444730
call fcn.00415500
test eax, eax
je 0x41521b
mov edi, dword [esp + 0x20]
xor ecx, ecx
mov ebp, dword [esp + 0x18]
mov esi, edi
shr esi, 8
mov eax, 0x45a208
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
mov ebx, dword [esp + 0x14]
cmp dword [eax - 8], ebx
mov ebx, dword [esp + 0x1c]
jne 0x4151b9
cmp dword [eax - 4], ebp
jne 0x4151b9
cmp dword [eax], ebx
je 0x4151c8
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x4151a3
or ecx, 0xffffffff
sub ecx, 0
je 0x415202
dec ecx
je 0x4151f1
dec ecx
jne 0x41521b
cmp esi, 6
jb 0x41521b
jne 0x415211
cmp edi, 0xf
jb 0x41521b
mov dword [0x45de34], 0x444650
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
cmp esi, 5
jb 0x41521b
jne 0x415211
cmp edi, 6
jb 0x41521b
cmp edi, 0xa
jmp 0x41520f
cmp esi, 6
jb 0x41521b
jne 0x415211
cmp edi, 0x100c
je 0x41521b
mov dword [0x45de34], 0x444650
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x415230
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x459178]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x18]
mov dword [ebx], 0
cmp dword [ebp], 0xffffffff
jne 0x41526d
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 0xc
push esi
mov esi, dword [esp + 0x20]
mov ecx, 0x100000
jmp 0x415280
cmp esi, 0x100000
mov dword [esp + 0x10], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
add dword [ebx], ecx
test al, al
je 0x4152da
test ecx, ecx
je 0x4152c3
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x415280
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x14]
xor al, al
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00435a0a
add esp, 8
ret 0xc
Function at 0x421e84
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edi, esi
push 8
shl edi, 0x18
pop ebx
lea ecx, [edi + edi]
mov edx, edi
mov eax, ecx
mov edi, ecx
xor eax, 0x4c11db7
and edx, 0x80000000
cmovne edi, eax
dec ebx
test ebx, ebx
jg 0x421e91
mov dword [esi*4 + 0x45d890], edi
inc esi
cmp esi, 0x100
jb 0x421e89
pop edi
pop esi
pop ebx
ret
Function at 0x42efae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x42efbe
mov dword [edi], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x10], esi
test ecx, ecx
je 0x42f016
mov eax, 0x8000
cmp ecx, eax
push esi
cmovb eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
je 0x42eff3
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
test eax, eax
jne 0x42f016
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42f008
mov esi, 0x80004005
jmp 0x42f016
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x43274c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x43276d
xor eax, eax
jmp 0x4328af
add dword [ebp + 8], 5
lea eax, [edx - 4]
push ebx
or ebx, 0xffffffff
add eax, ecx
mov dword [ebp - 4], eax
lea edx, [edi + ecx]
mov dword [ebp - 0xc], edx
cmp edx, eax
jae 0x4327a0
mov ecx, dword [ebp - 4]
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x432797
inc edx
cmp edx, ecx
jb 0x43278a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov edi, edx
sub edi, ecx
cmp edx, eax
jae 0x432893
mov ecx, edi
sub ecx, ebx
cmp ecx, 3
jbe 0x432826
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x18], ebx
test al, al
je 0x4327cb
cmp al, 0xff
jne 0x432853
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 8]
shl ebx, 8
or ebx, eax
sub ebx, edi
sub ebx, edx
mov dword [ebp - 0x14], ebx
test esi, esi
je 0x432867
movzx eax, byte [esi + 0x44cf74]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x432815
cmp al, 0xff
jne 0x432867
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0x10]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp - 0x14]
jmp 0x4327ec
dec ecx
shl esi, cl
and esi, 7
je 0x4327b7
movzx eax, byte [esi + 0x44cf74]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x44d410], 0
mov al, byte [ecx + 4]
je 0x432851
test al, al
je 0x432851
cmp al, 0xff
jne 0x4327b7
mov ebx, edi
and esi, 3
add esi, esi
or esi, 1
inc edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
jmp 0x43277d
mov edx, dword [ebp - 0xc]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x18]
shr eax, 8
add edi, 5
mov byte [edx + 2], al
jmp 0x43285c
mov edx, edi
xor eax, eax
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432aa0
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x432dd6
Capabilities:
Check os version
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x459178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x11c], ebx
mov ecx, ebx
movzx eax, byte [ecx + str.cw]
mov byte [eax + 0x45de40], cl
inc ecx
cmp ecx, 0x100
jb 0x432df6
movzx edi, byte [ebx + str.cw]
mov eax, edi
mov ecx, edi
and al, 0x80
movzx esi, al
neg esi
lea eax, [edi + edi]
sbb esi, esi
shl ecx, 8
and esi, 0x1b
xor esi, eax
and esi, 0xff
mov edx, esi
xor edx, edi
mov eax, edx
shl eax, 8
or eax, edi
shl eax, 8
or eax, edi
shl eax, 8
or eax, esi
mov dword [ebx*4 + 0x45ef40], eax
mov eax, ecx
or ecx, esi
or eax, edi
shl eax, 8
or eax, esi
shl ecx, 8
shl esi, 8
or ecx, edx
or esi, edx
shl eax, 8
or eax, edx
shl esi, 8
or esi, edi
shl ecx, 8
mov dword [ebx*4 + 0x45f340], eax
or ecx, edi
shl esi, 8
or esi, edi
mov dword [ebx*4 + 0x45f740], ecx
movzx edi, byte [ebx + 0x45de40]
mov dword [ebx*4 + 0x45fb40], esi
mov eax, edi
and al, 0x80
mov ebx, 0xff
movzx esi, al
neg esi
lea eax, [edi + edi]
sbb esi, esi
and esi, 0x1b
xor esi, eax
and esi, ebx
mov eax, esi
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, ebx
mov eax, ecx
and al, 0x80
movzx edx, al
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x1b
xor edx, eax
and edx, ebx
mov dword [ebp - 0x120], edx
mov ebx, edx
mov eax, dword [ebp - 0x120]
xor edx, esi
xor eax, ecx
xor ebx, edi
mov ecx, eax
mov dword [ebp - 0x120], eax
xor edx, edi
xor ecx, edi
mov edi, eax
mov eax, edx
shl eax, 8
xor edi, esi
mov esi, dword [ebp - 0x11c]
or eax, ecx
shl eax, 8
or eax, ebx
shl eax, 8
or eax, edi
mov dword [esi*4 + 0x45df40], eax
mov eax, ecx
shl eax, 8
or eax, ebx
shl eax, 8
or eax, edi
shl eax, 8
or eax, edx
mov dword [esi*4 + 0x45e340], eax
mov eax, ebx
shl eax, 8
or eax, edi
shl edi, 8
or edi, edx
shl eax, 8
shl edi, 8
or eax, edx
or edi, ecx
shl eax, 8
shl edi, 8
or eax, ecx
or edi, ebx
mov dword [esi*4 + 0x45e740], eax
mov ebx, esi
mov dword [ebx*4 + 0x45eb40], edi
inc ebx
mov dword [ebp - 0x11c], ebx
cmp ebx, 0x100
jb 0x432e0c
lea eax, [ebp - 0x118]
mov dword [0x461164], 0x433a87
push eax
mov dword [0x461160], 0x433ae1
mov dword [0x461168], 0x433b7d
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x432ff6
cmp dword [ebp - 0x114], 5
sbb eax, eax
inc eax
je 0x432ff6
lea ecx, [ebp - 0x140]
call fcn.00415500
test eax, eax
je 0x432ff6
mov eax, dword [ebp - 0x128]
shr eax, 0x19
and eax, 1
je 0x432ff6
mov dword [0x461164], 0x434828
mov dword [0x461160], 0x434880
mov dword [0x461168], 0x4349b1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435a0a
mov esp, ebp
pop ebp
ret
Function at 0x433004
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x43303a
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x43302d
cmp esi, ecx
jae 0x433126
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x4330b8
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
and eax, 0xff
shr ecx, 8
and ecx, 0xff
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
or edx, eax
mov eax, dword [ebp - 8]
shl edx, 8
movzx eax, byte [eax + 0x44d640]
xor ecx, eax
or ecx, edx
jmp 0x43310c
cmp edi, 6
jbe 0x43310c
cmp edx, 4
jne 0x43310c
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x43304c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43447a
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
push ecx
lea esi, [edi + 4]
mov ecx, esi
call fcn.00408994
test al, al
je 0x434492
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.00436b2f
pop ecx
test eax, eax
je 0x4344ad
push edi
push 0x43442e
mov ecx, eax
call fcn.00412080
jmp 0x4344af
xor eax, eax
push eax
mov ecx, esi
call fcn.0040bf26
mov ecx, esi
call fcn.0040892e
pop edi
mov ecx, eax
pop esi
jmp fcn.004122d0
Function at 0x43f0c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x459178]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00438c72
mov dword [ebp - 0x14], eax
cmp dword [0x45d848], esi
jne 0x43f1bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43f148
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43f29b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43f29b
push 0x44bd6c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43f29b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45d848], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45d84c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45d850], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d858], eax
test eax, eax
je 0x43f1b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d854], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43f1e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43f1d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43f1f5
push 4
pop eax
jmp 0x43f29d
cmp dword [ebp - 0x14], esi
je 0x43f1f5
push dword [0x45d848]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43f1da
mov eax, dword [0x45d854]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43f253
cmp dword [0x45d858], edi
je 0x43f253
push eax
call ebx
push dword [0x45d858]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43f253
test eax, eax
je 0x43f253
call ecx
test eax, eax
je 0x43f248
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43f248
test byte [ebp - 8], 1
jne 0x43f253
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43f283
mov eax, dword [0x45d84c]
cmp eax, edi
je 0x43f280
push eax
call ebx
test eax, eax
je 0x43f280
call eax
mov esi, eax
test esi, esi
je 0x43f280
mov eax, dword [0x45d850]
cmp eax, edi
je 0x43f280
push eax
call ebx
test eax, eax
je 0x43f280
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45d848]
call ebx
test eax, eax
je 0x43f29b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43f29d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435a0a
mov esp, ebp
pop ebp
ret
Function at 0x401570
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x394
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x25c]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
lea eax, [ebp - 0x25c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x401754
mov eax, dword [ebp - 0x158]
and eax, 0x10
test eax, eax
je 0x40165d
mov dword [esp + 4], 0x40c074
lea eax, [ebp - 0x158]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401726
mov dword [esp + 4], 0x40c076
lea eax, [ebp - 0x158]
add eax, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401726
lea eax, [ebp - 0x158]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40c079
lea eax, [ebp - 0x360]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x360]
mov dword [esp], eax
call fcn.00401570
jmp 0x401726
lea eax, [ebp - 0x158]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40c079
lea eax, [ebp - 0x360]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x360]
mov dword [esp], eax
call fcn.0040153a
test eax, eax
je 0x401726
mov dword [esp + 8], str..gica
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x360]
mov dword [esp], eax
call fcn.00401c3a
mov eax, dword [0x40f020]
add eax, 1
mov dword [0x40f020], eax
mov eax, dword [0x40f020]
mov dword [ebp - 0x36c], eax
fild dword [ebp - 0x36c]
fild dword [ebp + 0x10]
fdivp st(1)
fld qword [0x40c458]
fmulp st(1)
fstp qword [ebp - 0x18]
mov eax, dword [0x40f020]
fld qword [ebp - 0x18]
fstp qword [esp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._rRepairing_file__d____d___.0f___
call sub.msvcrt.dll_printf
mov ebx, dword [0x40f020]
lea eax, [ebp - 0x360]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [ebx*4 + 0x40fa40], eax
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x4015bf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
nop
mov ebx, dword [ebp - 4]
leave
ret