joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov al, 0x62
mov edx, dword [esp + 0x24]
mov byte [esp + 5], al
mov byte [esp + 0xd], al
xor eax, eax
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], eax
mov byte [esp + 4], 0x12
mov dword [esp + 0x1c], eax
mov byte [esp + 5], 0x22
mov dword [esp + 0x20], eax
push eax
lea eax, [esp + 8]
mov byte [esp + 0xa], 0x32
push eax
push 0
push 1
mov byte [esp + 0x17], 0x42
mov byte [esp + 0x18], 0x5a
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x82
mov byte [esp + 0x1c], 0xff
mov byte [esp + 0x1d], 0x24
mov byte [esp + 0x1e], 0x3a
mov byte [esp + 0x1f], 0x44
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x22], 0xc4
mov byte [esp + 0x23], 0x84
call fcn.0048c8a0
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret 4
Function at 0x48cf40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x1c], edx
jbe 0x48d04b
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x4b480c]
mov ecx, dword [ecx*4 + 0x4b500c]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x4b4c0c]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b440c]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x4b4c0c]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b500c]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b480c]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b440c]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x4b4c0c]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b500c]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b480c]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b440c]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x4b4c0c]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4b500c]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b480c]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4b440c]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x1c]
cmp edx, ecx
jb 0x48cf56
pop edi
pop ebx
pop esi
ret
Function at 0x4926e9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4b58a8
cmp edx, dword [eax]
je 0x49270b
add eax, 8
inc ecx
cmp eax, 0x4b5938
jl 0x4926fc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4b58a8]
jne 0x492839
mov eax, dword [0x4b722c]
cmp eax, 1
je 0x492813
test eax, eax
jne 0x49273c
cmp dword [0x4b5504], 1
je 0x492813
cmp edx, 0xfc
je 0x492839
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x492773
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0048f300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0048f3f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4927b6
lea eax, [ebp - 0x1a4]
push eax
call fcn.0048f3f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4a4270
push edi
call fcn.00496a00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0048f300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0048f310
lea eax, [ebp - 0xa0]
push 0x4b0074
push eax
call fcn.0048f310
push dword [esi + 0x4b58ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0048f310
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00496971
add esp, 0x2c
pop edi
jmp 0x492839
lea eax, [ebp + 8]
lea esi, [esi + 0x4b58ac]
push 0
push eax
push dword [esi]
call fcn.0048f3f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4019e0
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov ebx, edx
lea eax, [ebp - 0x20a]
mov esi, ecx
push eax
call fcn.0040cc90
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a9b2
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
add esp, 0x18
push 0
push eax
call esi
push 0x4226fc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a8fb
push 0x4226f8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a8fb
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push eax
call esi
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a8fb
push str..lnk
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a8fb
add esp, 0x18
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0x41d260
push 1
push 0
push 0x41d280
mov dword [ebp - 0x214], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401b59
mov eax, dword [ebp - 0x210]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x210]
push 0x4226fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x210]
push 0
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x41d270
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x401b59
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401b44
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x401b6c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x401b7c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret

Function at 0x401b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
xor eax, eax
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x26], ax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push edx
push 0
mov dword [ebp - 0x50], 0x4226fc
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401c05
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x4226fc
mov eax, edi
nop
mov cx, word [eax]
cmp cx, word [edx]
jne 0x401c56
test cx, cx
je 0x401c52
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x401c56
add eax, 4
add edx, 4
test cx, cx
jne 0x401c30
xor eax, eax
jmp 0x401c5b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401c72
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.0040cc90
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push eax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push 0x422864
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x668]
push eax
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x66c], eax
cmp eax, 0xffffffff
je 0x401c5f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x668], 0x10
lea eax, [ebp - 0x63c]
push 0x422868
push eax
jne 0x401d8d
call esi
test eax, eax
je 0x401df2
push 0x42286c
lea eax, [ebp - 0x63c]
push eax
call esi
test eax, eax
je 0x401df2
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401df2
push 4
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x401df2
call esi
test eax, eax
je 0x401df2
push 0x42286c
lea eax, [ebp - 0x63c]
push eax
call esi
test eax, eax
je 0x401df2
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
push 0x4226f8
lea eax, [ebp - 0x210]
push eax
call ebx
lea ecx, [ebp - 0x210]
call fcn.00401c10
lea eax, [ebp - 0x668]
push eax
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401d01
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
cmp eax, 1
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0040a822
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x7bff48
push 0x104
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push 0x4226fc
push str.TName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x20c], si
jne 0x401e96
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
push eax
push 0x41d2a0
push 1
push 0
push 0x41d2c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401ee6
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov ecx, 1
cmovns esi, ecx
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040a822
mov esp, ebp
pop ebp
ret

Function at 0x401f00
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x1a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4226f8
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040a8fb
add esp, 0xc
lea eax, [ebp - 0x210]
push str.wrqwer_
push 0x104
push eax
call fcn.0040a8fb
add esp, 0xc
lea eax, [ebp - 0x210]
push str.WeiDuanN_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x7c0150
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x401fc0
push 0x7bff48
push 0x104
push 0x7c0150
push 0x4226fc
push str.StartMenuPath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x7c0150
call fcn.00401c10
call fcn.00401e40
lea ecx, [ebp - 0x210]
call fcn.00401c10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret
Function at 0x401ff0
Capabilities:
Acquire debug privileges
Enumerate processes
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov ebx, 1
push 2
mov dword [ebp - 0x710], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
jne 0x402036
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x708]
mov dword [ebp - 0x708], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402023
lea eax, [ebp - 0x70c]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4020e0
lea eax, [ebp - 0x718]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4020ca
mov eax, dword [ebp - 0x718]
push 0
push 0
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x714]
push 0
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x70c]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x214], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x70c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4020e0
push 0x2b4
lea eax, [ebp - 0x4d8]
push 0
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x4d8]
push 0x101
push 0x2b4
push eax
push 0
lea eax, [ebp - 0x6e4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40216d
push dword [ebp - 0x700]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x710]
neg eax
sbb eax, eax
and ebx, eax
lea eax, [ebp - 0x708]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4020e0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a822
mov esp, ebp
pop ebp
ret
Function at 0x4021a0
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x426008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov ebx, ecx
lea eax, [ebp - 0x20a]
push eax
call fcn.0040cc90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push 0x4226f8
push eax
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push str..lnk
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0x41d260
push 1
push 0
push 0x41d280
mov dword [ebp - 0x214], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4022ce
mov eax, dword [ebp - 0x210]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x210]
push 0x4226fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x210]
push 0
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x41d270
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4022ce
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4022b9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4022e1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x4022f1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a822
mov esp, ebp
pop ebp
ret
Function at 0x405fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x405fcb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x406095
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
dec edi
jne 0x405fe0
pop edi
test esi, esi
je 0x4060ba
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x422d90]
dec esi
jne 0x4060a0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4067e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x406823
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406815
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x406834
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0040cd20
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x40689b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406896
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4068c8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4068ac
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.0040cd20
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x4068dc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4068d3
cmp byte [esi + 8], 0
je 0x4068d3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4069a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x4069d4
cmp byte [edi + 1], 0
je 0x4069cd
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4069da
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x4069ff
cmp byte [edi + 1], 0
je 0x4069f8
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x406a02
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x406a11
mov ebx, dword [edi + 0x18]
mov eax, 0xffff
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
cmp ebx, eax
jae 0x406a14
mov dword [ebp - 4], ebx
push esi
push 0x404
call fcn.0040a831
mov esi, eax
add esp, 4
test esi, esi
jne 0x406a2f
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 4
mov dword [ebp - 0x10], 0
cmp ecx, eax
jbe 0x406b2f
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x1c], edx
sub ebx, ecx
mov dword [ebp - 0x18], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x406a90
cmp byte [edi + 1], 0
je 0x406b2f
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x406a93
mov dword [edi + 0x18], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0xc], ebx
je 0x406abb
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406ab6
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x406ae4
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x406ace
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.0040cd20
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x406b2f
lea eax, [ebx - 3]
test eax, eax
jle 0x406b1e
dec eax
cmp byte [eax + esi], 0x50
jne 0x406b10
cmp byte [eax + esi + 1], 0x4b
jne 0x406b10
cmp byte [eax + esi + 2], 5
jne 0x406b10
cmp byte [eax + esi + 3], 6
je 0x406b16
test eax, eax
jg 0x406af4
jmp 0x406b1e
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
jne 0x406b2f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
cmp eax, ecx
jb 0x406a46
push esi
call fcn.0040a8c3
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret