joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412880
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446508
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4584b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov ecx, dword [edi]
sub ecx, 0x10
mov dword [ebp - 0x18], 0
call fcn.00401240
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
add esi, 0xfffffff0
or eax, 0xffffffff
lea ecx, [esi + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4128e8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x412910
mov ecx, dword [ebp + 8]
push str.Error:_Ini_File_Not_Exist
call fcn.004035d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
mov eax, 0x104
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041561d
add esp, 4
mov esi, eax
call fcn.00401c40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x41294c
push 0x80004005
call fcn.004019f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0
push dword [edi]
push 0x104
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [edi]
push 0x104
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0x103
jb 0x412a17
mov edi, 0x104
lea ecx, [ecx]
mov eax, ebx
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4129ca
test dx, dx
je 0x4129c6
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4129ca
add ecx, 4
add eax, 4
test dx, dx
jne 0x4129a4
xor eax, eax
jmp 0x4129cf
sbb eax, eax
or eax, 1
test eax, eax
je 0x412a17
push esi
call fcn.0042cc84
add edi, 0x104
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041561d
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push edi
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [edi - 1]
cmp eax, ecx
jae 0x4129a0
test esi, esi
jne 0x412a1f
xor ecx, ecx
jmp 0x412a33
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412a24
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.004085a0
push esi
call fcn.0042cc84
mov esi, dword [ebp - 0x10]
add esp, 4
add esi, 0xfffffff0
mov ecx, esi
call fcn.00401240
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov dword [edi], eax
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412a79
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x440ad1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4584b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00430a4d
mov dword [ebp - 0x14], eax
cmp dword [0x45b6ec], esi
jne 0x440bc4
push 0x800
push esi
push 0x44f320
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x440b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x440ca4
push esi
push esi
push 0x44f320
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x440ca4
push 0x44f338
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x440ca4
push eax
call ebx
push 0x44f344
push edi
mov dword [0x45b6ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x44f354
push edi
mov dword [0x45b6f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x44f368
push edi
mov dword [0x45b6f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45b6fc], eax
test eax, eax
je 0x440bc1
push 0x44f384
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45b6f8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x440be9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x440bdc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x440bfe
push 4
pop eax
jmp 0x440ca6
cmp dword [ebp - 0x14], esi
je 0x440bfe
push dword [0x45b6ec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x440be3
mov eax, dword [0x45b6f8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x440c5c
cmp dword [0x45b6fc], edi
je 0x440c5c
push eax
call ebx
push dword [0x45b6fc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x440c5c
test eax, eax
je 0x440c5c
call ecx
test eax, eax
je 0x440c51
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x440c51
test byte [ebp - 8], 1
jne 0x440c5c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x440c8c
mov eax, dword [0x45b6f0]
cmp eax, edi
je 0x440c89
push eax
call ebx
test eax, eax
je 0x440c89
call eax
mov esi, eax
test esi, esi
je 0x440c89
mov eax, dword [0x45b6f4]
cmp eax, edi
je 0x440c89
push eax
call ebx
test eax, eax
je 0x440c89
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45b6ec]
call ebx
test eax, eax
je 0x440ca4
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x440ca6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c3b2
mov esp, ebp
pop ebp
ret
Function at 0xf28058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf281a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf2807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2806a
add dl, dl
jne 0xf28089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf280dc
xor eax, eax
add dl, dl
jne 0xf28096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2817d
add dl, dl
jne 0xf280a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf280b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf280bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf280c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf280d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf28075
mov eax, 1
add dl, dl
jne 0xf280ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf280f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf280e1
sub eax, ebx
mov ebx, 1
jne 0xf28128
mov ecx, 1
add dl, dl
jne 0xf2810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf28119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf28105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf28075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf2813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf28136
cmp eax, 0x7d00
jae 0xf2816d
cmp eax, 0x500
jb 0xf28168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf28075
cmp eax, 0x7f
ja 0xf28170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf28075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf2819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf28075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405a1b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405a52
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x405a4e
jmp 0x405a40
cmp esi, eax
jae 0x405a52
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405a40
cmp esi, eax
jb 0x405a59
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40f240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0xa], edx
mov byte [esi + 0xe], dl
mov word [esi + 8], dx
push edi
mov edi, 1
cmp byte [eax], dl
je 0x40f2e4
push 0x5f7dc0
push eax
call fcn.005bc9d4
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x40f2e4
push eax
push edi
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.005bc8fb
movzx ecx, byte [ebp - 0x14]
movzx eax, word [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov byte [esi + 4], cl
mov cx, word [ebp - 0x10]
mov word [esi + 6], ax
movzx eax, word [ebp - 0xc]
mov word [esi + 8], cx
movzx ecx, byte [ebp - 0xa]
add esp, 0x10
mov byte [esi + 5], dl
mov dx, word [ebp - 0xe]
mov word [esi + 0xc], ax
pop edi
mov word [esi + 0xa], dx
mov byte [esi + 0xe], cl
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.005bb30e
mov esp, ebp
pop ebp
ret

Function at 0x40f300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov word [esi + 0x10], ax
mov ax, word [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 1
cmp word [edi + 8], ax
jbe 0x40f390
mov ecx, dword [edi]
movzx eax, ax
inc eax
push 0
shl eax, 4
push eax
push ecx
call fcn.005bcb9e
add esp, 0xc
test eax, eax
jne 0x40f390
mov edx, dword [edi]
push edx
push ebx
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.005bc8fb
add esp, 0x10
test eax, eax
je 0x40f390
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push esi
call fcn.005bc9f0
mov dl, byte [ebp - 8]
add esp, 0xc
pop edi
mov byte [esi + 0x10], dl
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x41a4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
movzx ebx, word [ebp + 0x10]
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], ebx
test bl, bl
jne 0x41a51d
mov bl, 0x18
push 2
lea eax, [ebp - 0x408]
push eax
call fcn.004bcc84
mov ecx, dword [ebp - 0x408]
test cx, cx
je 0x41a608
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x404]
sub edi, edx
push esi
jmp 0x41a550
mov eax, 0x400
cmp cx, ax
jbe 0x41a5c2
xor eax, eax
lea esp, [esp]
lea esi, [ebp + eax - 0x404]
mov cl, byte [edi + esi]
xor cl, bl
inc eax
mov byte [esi], cl
cmp eax, 0x400
jl 0x41a560
mov ecx, dword [ebp - 0x40c]
push 0x400
lea edx, [ebp - 0x404]
push edx
call fcn.004bcc84
mov ecx, dword [ebp - 0x408]
add dword [ebp + 0xc], 0x400
add ecx, 0xfc00
add edi, 0x400
mov dword [ebp - 0x408], ecx
test cx, cx
jne 0x41a550
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
movzx edi, cx
xor eax, eax
test edi, edi
jle 0x41a5f3
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x404]
sub ecx, edx
jmp 0x41a5e0
lea esi, [ebp + eax - 0x404]
mov dl, byte [ecx + esi]
xor dl, bl
inc eax
mov byte [esi], dl
cmp eax, edi
jl 0x41a5e0
mov ecx, dword [ebp - 0x40c]
push edi
lea eax, [ebp - 0x404]
push eax
call fcn.004bcc84
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret

Function at 0x41a620
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push 2
lea eax, [ebp - 4]
push eax
mov ecx, ebx
call fcn.004bc5e9
cmp eax, 2
jne 0x41a693
mov ax, word [ebp - 4]
mov ecx, dword [ebp + 0x10]
movzx edx, ax
cmp edx, ecx
jg 0x41a652
movzx eax, ax
mov dword [ebp - 8], eax
jmp 0x41a658
movzx ecx, cx
mov dword [ebp - 8], ecx
push esi
movzx esi, word [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
mov ecx, ebx
call fcn.004bc5e9
mov al, byte [ebp - 4]
mov ecx, 0x18
test al, al
je 0x41a679
movzx ecx, al
xor eax, eax
test esi, esi
jle 0x41a688
nop
xor byte [eax + edi], cl
inc eax
cmp eax, esi
jl 0x41a680
mov ax, word [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c590
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp dword [eax - 4], 1
movzx ebx, word [eax - 0xc]
push edi
jle 0x41c5b0
mov eax, dword [eax - 0xc]
push eax
mov ecx, esi
call fcn.00405c00
mov edx, dword [esi]
mov edi, dword [ebp + 0x10]
push ebx
lea ecx, [edi + 2]
push edx
push ecx
call fcn.005bc350
add esp, 0xc
test bx, bx
je 0x41c5ea
jmp 0x41c5d0
movzx eax, bx
mov al, byte [edi + eax + 1]
cmp al, 0xd
je 0x41c5df
cmp al, 0xa
jne 0x41c5ea
add ebx, 0xffff
test bx, bx
jne 0x41c5d0
mov word [edi], bx
mov edx, 0x18
test bl, bl
je 0x41c5f9
movzx edx, bl
movzx esi, bx
test esi, esi
jle 0x41c60b
lea eax, [edi + 2]
mov ecx, esi
xor byte [eax], dl
inc eax
dec ecx
jne 0x41c605
mov ecx, dword [ebp + 8]
add esi, 2
push esi
push edi
call fcn.004bcc84
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41c7e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push eax
xor bl, bl
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41c85f
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x41c853
push edi
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x41c852
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x41c834
mov edx, dword [eax - 0xc]
push edx
mov ecx, esi
call fcn.00405c00
mov ecx, dword [esi]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x41c838
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov al, 1
pop ebx
pop ebp
ret
mov al, bl
pop ebx
pop ebp
ret
Function at 0x41d120
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc02b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call fcn.004b5c24
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41d16b
push 0x80004005
call fcn.004047e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x154], eax
push esi
lea ecx, [ebp - 0x154]
push str._s.
push ecx
mov dword [ebp - 4], 0
mov ebx, 1
call fcn.004065c0
mov edi, dword [ebp - 0x154]
add esp, 0xc
lea edx, [ebp - 0x150]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d252
lea ecx, [ecx]
cmp byte [ebp - 0x124], 0
je 0x41d231
mov ecx, 0x5f99e0
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41d1f4
test dl, dl
je 0x41d1f0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41d1f4
add eax, 2
add ecx, 2
test dl, dl
jne 0x41d1d4
xor eax, eax
jmp 0x41d1f9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d231
mov ecx, 0x5f99dc
lea eax, [ebp - 0x124]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41d228
test dl, dl
je 0x41d224
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41d228
add eax, 2
add ecx, 2
test dl, dl
jne 0x41d208
xor eax, eax
jmp 0x41d22d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41d249
lea eax, [ebp - 0x150]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41d1c0
jmp 0x41d24b
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d275
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x41d370
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc06b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call fcn.004b5c24
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41d3bb
push 0x80004005
call fcn.004047e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x254], edi
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x258]
push edx
push esi
mov dword [ebp - 4], 0
call fcn.005bd9ac
add esp, 0x14
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d454
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [ebx]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x254]
push str._s_s_s
push ecx
call fcn.004065c0
mov edi, dword [ebp - 0x254]
add esp, 0x14
push edi
call ebx
lea edx, [ebp - 0x250]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41d410
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d477
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
Function at 0x420460
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x66c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x80
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x9c], edi
xor esi, esi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x420588
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, eax
mov dword [ebp - 0x98], edx
test edx, edx
jne 0x4204cb
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0xc]
xor ebx, ebx
cmp dword [eax], ebx
je 0x42058e
xor ecx, ecx
jmp 0x4204e6
mov edi, dword [ebp - 0x9c]
movsx edx, word [edx + 0xa]
mov eax, dword [eax + ecx]
push edx
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.005bc350
add esp, 0xc
test ebx, ebx
jle 0x42051b
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x420503
mov dx, word [0x5f9bf4]
mov word [edi], dx
mov edi, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420530
sub eax, esi
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x420540
mov edx, dword [ebp - 0x98]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [edx + 0xc]
lea esi, [ebx + 1]
mov ebx, esi
cmp dword [eax + ebx*4], 0
lea ecx, [ebx*4]
jne 0x4204e0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb30e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bb30e
mov esp, ebp
pop ebp
ret

Function at 0x4205b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi]
xor ecx, ecx
test edx, edx
jle 0x4205f2
push ebx
push esi
mov esi, dword [ebp + 0xc]
jmp 0x4205d0
movzx ebx, byte [ecx + esi]
xor ebx, eax
shr ax, 8
and ebx, 0xff
xor ax, word [ebx*2 + 0x5f9bf8]
inc ecx
movzx eax, ax
cmp ecx, edx
jl 0x4205d0
pop esi
pop ebx
mov word [edi], ax
pop edi
pop ebp
ret
Function at 0x421300
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x42131e
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x421315
sub edi, ecx
mov eax, edi
and eax, 0x3f
mov ecx, edi
sub ecx, eax
cmp eax, 0x38
jae 0x421331
add ecx, 0x40
jmp 0x421334
sub ecx, 0xffffff80
mov eax, ecx
push eax
mov dword [ebp + 0x10], ecx
call fcn.004a8048
add esp, 4
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x42140e
push esi
xor esi, esi
test edi, edi
je 0x42136b
mov ecx, dword [ebp + 0xc]
sub ecx, ebx
mov dword [ebp + 0xc], edi
mov esi, edi
nop
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec dword [ebp + 0xc]
jne 0x421360
mov eax, dword [ebp + 0x10]
mov byte [esi + ebx], 0x80
inc esi
add eax, 0xfffffff8
cmp esi, eax
jae 0x421391
sub eax, esi
push eax
lea ecx, [esi + ebx]
push 0
push ecx
mov dword [ebp + 0xc], eax
call fcn.005bb320
add esp, 0xc
add esi, dword [ebp + 0xc]
lea eax, [edi*8]
shr edi, 0x1d
mov dword [esi + ebx], eax
mov dword [esi + ebx + 4], edi
xor esi, esi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
cmp dword [ebp + 0x10], esi
jbe 0x4213d8
lea ecx, [esi + ebx]
lea eax, [ebp - 0x10]
call fcn.00420710
add esi, 0x40
cmp esi, dword [ebp + 0x10]
jb 0x4213c5
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
pop esi
cmp eax, ecx
je 0x4213fa
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
push ebx
call fcn.004a803d
add esp, 4
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret