joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454434
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4545c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xf]
mov edx, 0x456aa8
mov cl, 9
call fcn.00402a74
xor eax, eax
push ebp
push 0x454583
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x456a58]
call fcn.00403f4c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 0xffff
mov ecx, 0x4545e0
mov dl, 1
mov eax, dword [0x40c8d4]
call fcn.0040fd7c
mov dword [ebp - 4], eax
lea edx, [ebp - 0xf]
mov ecx, 0xa
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 8]
mov edx, 0x456a94
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 8]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
mov edx, 0x456a80
call fcn.00403d2c
mov edx, dword [ebp - 0x138]
xor ecx, ecx
mov eax, ebx
call fcn.0045469c
mov edx, dword [ebp - 0x134]
lea eax, [ebp - 0x130]
mov ecx, 0xff
call fcn.00403d64
lea edx, [ebp - 0x130]
lea eax, [ebp - 0x30]
mov cl, 0x20
call fcn.00402a74
lea edx, [ebp - 0x30]
mov ecx, 0x20
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
mov al, byte [0x456a6c]
add eax, 0x30
mov byte [ebp - 5], al
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x456a78], 0
je 0x45455d
cmp byte [0x456a7b], 0
je 0x454557
mov byte [ebp - 5], 0x4f
jmp 0x454561
mov byte [ebp - 5], 0x49
jmp 0x454561
mov byte [ebp - 5], 0x45
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
call fcn.00402e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4545aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4545cf
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.00403b2c
ret
Function at 0x45469c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403f3c
xor eax, eax
push ebp
push 0x454826
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0xb4
lea eax, [ebp - 0xc]
call fcn.00403b08
lea eax, [ebp - 0x211]
xor ecx, ecx
mov edx, 0x200
call fcn.00402b98
lea eax, [ebp - 0x412]
mov cl, 0x20
mov edx, 0x200
call fcn.00402b98
mov eax, dword [ebp - 4]
call fcn.00403d88
mov edi, eax
sub bl, 1
jb 0x454717
je 0x45476d
jmp 0x4547eb
mov eax, dword [ebp - 4]
call fcn.00403f4c
lea edx, [ebp - 0x211]
mov ecx, edi
call fcn.00402840
dec edi
test edi, edi
jl 0x45475d
inc edi
lea esi, [ebp - 0x211]
mov bl, byte [esi]
xor bl, byte [ebp - 5]
lea ecx, [ebp - 0x10]
xor eax, eax
mov al, bl
mov edx, 2
call fcn.00407f90
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00403d90
inc esi
dec edi
jne 0x454738
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00403b5c
jmp 0x4547f8
mov eax, dword [ebp - 4]
call fcn.00403f4c
lea edx, [ebp - 0x211]
mov ecx, edi
call fcn.00402840
xor esi, esi
cmp edi, esi
jle 0x4547de
cmp esi, 0x27
mov bl, byte [ebp + esi - 0x211]
sub bl, 0x30
cmp bl, 9
jbe 0x45479d
sub bl, 7
xor eax, eax
mov al, byte [ebp + esi - 0x210]
sub eax, 0x30
cmp eax, 0xa
jle 0x4547b1
sub eax, 7
mov edx, ebx
shl edx, 4
add dl, al
mov ebx, edx
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x418]
mov edx, ebx
call fcn.00403cb0
mov edx, dword [ebp - 0x418]
lea eax, [ebp - 0xc]
call fcn.00403d90
inc esi
inc esi
cmp edi, esi
jg 0x454788
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00403b5c
jmp 0x4547f8
mov eax, dword [ebp + 8]
mov edx, 0x454840
call fcn.00403b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45482d
lea eax, [ebp - 0x418]
call fcn.00403b08
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403b2c
lea eax, [ebp - 4]
call fcn.00403b08
ret

Function at 0x454ac8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, 0x454928
call fcn.00406184
mov eax, dword [0x455dc4]
mov eax, dword [eax]
call fcn.00444a5c
push 0x454b48
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x454b27
mov ecx, dword [0x455bb4]
mov eax, dword [0x455dc4]
mov eax, dword [eax]
mov edx, dword [0x45201c]
call fcn.00444a74
mov eax, dword [0x455dc4]
mov eax, dword [eax]
call fcn.00444af4
jmp 0x454b3c
push 0
mov cx, word [0x454b60]
mov dl, 1
mov eax, 0x454b6c
call fcn.0044867c
push ebx
call sub.kernel32.dll_ReleaseMutex
pop ebx
call fcn.004039d0
shl dword [edx - 0x732552c], 0xb0
leave
mov edi, 0xb9a7bbcd
fadd st(0), st(0)
in eax, dx
mov bl, 0xcc
sal dl, 1
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
Function at 0x5ad380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdd000]
push edi
jmp 0x5ad39a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5ad3a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ad390
mov eax, 1
add ebx, ebx
jne 0x5ad3b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5ad3c4
jne 0x5ad3e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ad3e3
dec eax
add ebx, ebx
jne 0x5ad3d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5ad3a8
add ebx, ebx
jne 0x5ad3df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5ad435
xor ecx, ecx
sub eax, 3
jb 0x5ad3fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5ad46a
sar eax, 1
mov ebp, eax
jmp 0x5ad406
add ebx, ebx
jne 0x5ad406
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ad3d4
inc ecx
add ebx, ebx
jne 0x5ad414
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ad3d4
add ebx, ebx
jne 0x5ad421
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5ad416
jne 0x5ad432
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5ad416
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5ad454
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5ad446
jmp 0x5ad396
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5ad454
add edi, ecx
jmp 0x5ad396
pop esi
mov edi, esi
mov ecx, 3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5ad472
cmp byte [edi], 7
jne 0x5ad472
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5ad477
lea edi, [esi + 0x1aa000]
mov eax, dword [edi]
or eax, eax
je 0x5ad4ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c63d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c64dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5ad4a4
mov ecx, edi
jns 0x5ad4d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c64e0]
or eax, eax
je 0x5ad4e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5ad4c1
call dword [esi + 0x1c64f0]
mov ebp, dword [esi + 0x1c64e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5ad523
sub esp, 0xffffff80
jmp 0x48821c
Function at 0x401060
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x40b2ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_3
xor eax, eax
mov ecx, 0x8a
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
push 2
rep stosd dword es:[edi], eax
mov dword [esp + 0x24c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010ce
push 0
push str.Error
push str.Get_process_snapshot_error
push 0
call esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40117b
mov esi, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::operator_1
mov edx, dword [esp + 0xc]
push str.iexplore.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x401123
mov eax, dword [esp + 0xc]
push str.chrome.exe
push eax
call esi
add esp, 8
test eax, eax
jne 0x401166
mov ecx, dword [esp + 0xc]
push str.iexplore.exe
push ecx
call esi
add esp, 8
test eax, eax
jne 0x401146
mov edx, dword [ebx + 4]
mov dword [ebx + edx*4 + 0x2008], 1
jmp 0x401154
mov eax, dword [ebx + 4]
mov dword [ebx + eax*4 + 0x2008], 2
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x18]
mov dword [ebx + ecx*4 + 8], edx
mov eax, dword [ebx + 4]
inc eax
mov dword [ebx + 4], eax
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4010ef
jmp 0x40118b
push 0
push str.error
push str.Process32First_Error
push 0
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 4]
pop edi
pop esi
pop ebx
test eax, eax
mov dword [esp + 0x238], 0xffffffff
lea ecx, [esp]
jne 0x4011c7
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
add esp, 0x23c
ret
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x230]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x23c
ret

Function at 0x4011f0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
call fcn.00401040
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x401231
push edi
push esi
mov ecx, ebx
call fcn.00401050
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebp
jl 0x401203
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401390
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x40b310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x20], 0
call sub.MFC42u.DLL_AfxGetModuleState
mov ebp, dword [eax + 8]
mov eax, dword [esp + 0x28]
push 0x40e0e0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4013fb
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x18]
mov ebx, eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
call sub.MFC42u.DLL_CString::operator
mov eax, dword [esi + 0x10]
lea edx, [eax + eax*2]
inc eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
lea ecx, [esi + edx*4 + 0x14]
mov dword [ecx], eax
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
mov dword [ecx + 4], edx
push eax
add ecx, 8
call sub.MFC42u.DLL_CString::operator
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call fcn.004048c0
mov ecx, dword [esi + 0xc]
mov byte [esp + 0x24], 0
add ecx, eax
mov dword [esi + 0xc], ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x4014b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
push edi
xor esi, esi
mov edx, dword [ecx + 0x20]
push eax
push esi
push 0x7e9
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x18], eax
cmp ecx, esi
mov dword [esp + 0x14], esi
mov eax, 1
jle 0x4015be
lea ecx, [ebx + 0x14]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call fcn.004048c0
mov esi, eax
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, dword [esp + 0x14]
add esp, 4
mov edi, eax
mov eax, dword [edx]
push esi
push eax
push edi
push ebp
call fcn.00404720
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [ecx + 8]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42u.DLL_CString::CString_2
push esi
push edi
mov ecx, ebx
call fcn.004015d0
push edi
mov esi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
test esi, esi
jne 0x40158a
mov ecx, ebx
call fcn.00401730
test eax, eax
je 0x4015ad
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 4]
push esi
push esi
push 0x7ec
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40159e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0xc
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x10]
cmp edx, eax
jl 0x4014f9
mov dword [ebx + 0x10], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov dword [ebx + 0x10], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4015d0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40b328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [esp + 0x2c]
xor esi, esi
mov ebp, dword [edi + 8]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
mov dword [esp + 0x10], ecx
jne 0x40162a
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], eax
call sub.MFC42u.DLL_CString::CString
xor eax, eax
jmp 0x4016b4
mov ebx, dword [esp + 0x28]
test ebx, ebx
jbe 0x40168f
lea edx, [esi + 0x1000]
mov dword [esp + 0x28], 0
cmp edx, ebx
jbe 0x40164a
mov eax, ebx
sub eax, esi
jmp 0x40164f
mov eax, 0x1000
lea edx, [esp + 0x28]
push 0
push edx
push eax
mov eax, dword [esp + 0x30]
lea edx, [esi + eax]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4016c9
mov eax, dword [esp + 0x28]
add esi, eax
add ebp, eax
mov eax, dword [edi + 4]
push ebp
push 1
push 0x7e9
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x10]
cmp esi, ebx
jb 0x401632
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
lea ecx, [esp + 0x2c]
add eax, ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [edi + 8], eax
call sub.MFC42u.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [edi + 4]
push 0
push eax
push 0x7ea
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
jmp 0x4016b4
Function at 0x402290
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40b554
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x470], 0
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 0x10]
push 0x104
push eax
mov byte [esp + 0x478], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_1
push str._regsvr32.exe
lea ecx, [esp + 8]
call fcn.00402b10
lea edx, [esp + 4]
lea ecx, [esp + 8]
push edx
mov byte [esp + 0x474], 2
call fcn.00402b0a
lea ecx, [esp + 4]
mov byte [esp + 0x470], 1
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
lea eax, [esp + 0x218]
push eax
push ecx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40233f
xor esi, esi
jmp 0x4023c9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42u.DLL_CString::CString_2
push 0x40e180
lea ecx, [esp + 8]
mov byte [esp + 0x474], 3
call fcn.00402b10
lea eax, [esp + 0x47c]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x474], 4
call fcn.00402b0a
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x478]
push 5
push 0x40e4b4
push ecx
push edx
push 0x40e4b4
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 4]
mov byte [esp + 0x470], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x470], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x470], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x47c]
mov dword [esp + 0x470], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x468]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x470
ret

Function at 0x403020
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
xor edx, edx
cmp eax, esi
sete dl
mov eax, edx
pop esi
ret
Function at 0x406720
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
cmp edx, 8
push edi
jae 0x40677c
mov eax, dword [ecx]
or edx, 8
shr eax, 2
xor esi, esi
cmp edx, 1
mov ebx, dword [eax*4 + 0x40ecf0]
je 0x406772
mov edi, dword [esp + 0x18]
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [edx + edi*8]
mov ebp, dword [ecx + ebp*4 + 8]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x40ecf0]
add esi, eax
cmp edx, 1
jne 0x406747
lea eax, [esi + ebx]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ebx, dword [ecx]
mov eax, 0x800
sub eax, ebx
shr eax, 2
cmp edx, 0x10
mov eax, dword [eax*4 + 0x40ecf0]
jae 0x4067ef
mov esi, dword [ecx + 4]
xor edi, edi
shr esi, 2
mov ebx, dword [esi*4 + 0x40ecf0]
lea esi, [edx - 8]
or esi, 8
add eax, ebx
cmp esi, 1
je 0x406840
mov ebx, dword [esp + 0x18]
mov edx, esi
shr esi, 1
and edx, 1
lea ebp, [esi + ebx*8]
mov ebp, dword [ecx + ebp*4 + 0x208]
sub ebp, edx
neg edx
xor ebp, edx
shr ebp, 2
and ebp, 0x1ff
mov edx, dword [ebp*4 + 0x40ecf0]
add edi, edx
cmp esi, 1
jne 0x4067b8
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edi, dword [ecx + 4]
mov esi, 0x800
sub esi, edi
xor edi, edi
shr esi, 2
mov ebx, dword [esi*4 + 0x40ecf0]
lea esi, [edx - 0x10]
or esi, 0x100
add eax, ebx
cmp esi, 1
je 0x406840
mov edx, esi
shr esi, 1
and edx, 1
mov ebx, dword [ecx + esi*4 + 0x408]
sub ebx, edx
neg edx
xor ebx, edx
shr ebx, 2
and ebx, 0x1ff
mov ebp, dword [ebx*4 + 0x40ecf0]
add edi, ebp
cmp esi, 1
jne 0x406815
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x409970
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp edi, dword [ecx + 0x33678]
jae 0x409a38
mov edx, edi
xor esi, esi
or edx, 0x40
cmp edx, 1
je 0x4099be
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [ebx + edx]
mov ebp, dword [ecx + ebp*4 + 0x28720]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x40ecf0]
add esi, eax
cmp edx, 1
jne 0x409990
lea eax, [ebx + edi]
inc edi
cmp edi, 0xe
mov dword [ecx + eax*4 + 0x32a34], esi
jb 0x409978
cmp edi, dword [ecx + 0x33678]
jae 0x409a38
mov edx, edi
xor esi, esi
or edx, 0x40
cmp edx, 1
je 0x409a10
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [ebx + edx]
mov ebp, dword [ecx + ebp*4 + 0x28720]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x40ecf0]
add esi, eax
cmp edx, 1
jne 0x4099e2
mov edx, edi
lea eax, [ebx + edi]
and edx, 0x7fffffe
add edx, 0x7fffff6
shl edx, 5
add edx, esi
inc edi
mov dword [ecx + eax*4 + 0x32a34], edx
mov eax, dword [ecx + 0x33678]
cmp edi, eax
jb 0x4099d6
add ebx, 0x40
cmp ebx, 0x100
jl 0x409976
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409a50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
lea eax, [ecx + 0x32a34]
lea edx, [ecx + 0x32e34]
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xca8d
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jmp 0x409a85
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, 4
mov eax, edi
mov dword [esp + 0x2c], eax
mov ebx, dword [edx]
add edx, 4
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x409a98
mov edx, dword [esp + 0x20]
lea ecx, [ecx + edx*4 + 0x32e44]
mov dword [esp + 0x30], ecx
cmp eax, 0x400
jge 0x409ac5
xor ebx, ebx
mov bl, byte [eax + 0x40e4e8]
jmp 0x409aee
cmp eax, 0x80000
jge 0x409ade
mov edx, eax
xor ebx, ebx
shr edx, 9
mov bl, byte [edx + 0x40e4e8]
add ebx, 0x12
jmp 0x409aee
mov ecx, eax
xor ebx, ebx
shr ecx, 0x12
mov bl, byte [ecx + 0x40e4e8]
add ebx, 0x24
mov ecx, ebx
mov edx, ebx
shr ecx, 1
and edx, 1
dec ecx
or edx, 2
mov esi, eax
shl edx, cl
xor ebp, ebp
mov edi, 1
mov dword [esp + 0x24], ebp
sub esi, edx
test ecx, ecx
je 0x409b5f
mov dword [esp + 0x28], ecx
mov ebp, dword [esp + 0x10]
mov ecx, edi
sub ecx, ebx
mov eax, esi
add ecx, edx
and eax, 1
add edi, edi
mov ecx, dword [ebp + ecx*4 + 0x28b1c]
mov ebp, eax
sub ecx, eax
or edi, eax
neg ebp
mov eax, dword [esp + 0x28]
xor ecx, ebp
mov ebp, dword [esp + 0x24]
shr ecx, 2
and ecx, 0x1ff
shr esi, 1
add ebp, dword [ecx*4 + 0x40ecf0]
dec eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebp
jne 0x409b14
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add edx, ebx
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x30]
add edx, ebp
inc eax
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
jl 0x409ab4
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
add eax, 0x40
add ebx, 0x200
add edi, 0x100
add edx, 0x80
cmp eax, 0xcb8d
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jl 0x409a81
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x409be0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
add ecx, 0x33634
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
xor esi, esi
mov edx, 1
mov ebx, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
and eax, 1
mov ecx, dword [ecx + edx*4 + 0x28ce8]
mov ebp, eax
sub ecx, eax
add edx, edx
neg ebp
xor ecx, ebp
or edx, eax
shr ecx, 2
and ecx, 0x1ff
shr edi, 1
mov ebp, dword [ecx*4 + 0x40ecf0]
add esi, ebp
dec ebx
jne 0x409c07
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc edi
mov dword [eax], esi
add eax, 4
cmp edi, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jb 0x409bfb
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [edx + 0x33674], 0x10
pop ebx
add esp, 0xc
ret