joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4509b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x494ec3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048621d
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048b98d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048cf28
test eax, eax
je 0x450acc
mov ecx, dword [esp + 0x3c]
call fcn.0048b9ba
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x450a90
push edi
mov ecx, esi
call fcn.00488f81
mov ecx, esi
call fcn.00450c30
cmp dword [esp + 0x38], 1
jne 0x450ac5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004890eb
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x453510
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x453543
push esi
call fcn.00456600
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45353c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4535c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4535b2
mov eax, dword [esi + 8]
test eax, eax
je 0x453567
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4535ae
cmp eax, 2
je 0x4535b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45355a
cmp eax, 3
je 0x45358d
cmp eax, 1
jne 0x45355a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45355a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45355a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004535f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4535d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004535f0
add esp, 4
pop esi
ret

Function at 0x461cc0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x461d63
test eax, eax
jbe 0x461d63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x461d63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x461d0e
xor esi, esi
jmp 0x461d14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x461d3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00414870
add esi, eax
push esi
mov ebx, esi
call fcn.00414870
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x461d20
pop ebp
test edi, edi
pop edi
jne 0x461d63
test ebx, ebx
je 0x461d63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00474f40
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x461ea5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x461fbd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x461fbd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048666f
mov esi, eax
test esi, esi
je 0x461fbd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x461fbd
mov ecx, esi
call fcn.00461e10
cmp edi, eax
jge 0x461fbd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x461f43
mov dword [esp + 0x34], 1
jmp 0x461f9e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x461fbd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004613c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x466ed0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x466f1a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x466f49
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x466f8b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x487013
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48704b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048509d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00485075
jmp 0x487057
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48870a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48874c
call fcn.0048e42f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48874c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x488743
xor eax, eax
jmp 0x488754
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048875a
pop edi
pop esi
pop ebx
ret 4

Function at 0x48e95f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48e98d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48e9ab
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048e8c5
jmp 0x48e9ab
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48e9ab
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048e8c5
test edi, edi
mov eax, edi
jne 0x48e995
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x103dd638
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103dd642
pushal
call 0x103dd648
pop ebp
sub ebp, 0x10
add byte [eax], al
sub ebp, 0x3dd638
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103dd66c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103dd675
mov eax, 0x3dd638
add eax, ebp
add eax, 0x63
mov ecx, 0x61c
mov edx, 0xc8472192
xor byte [eax], dl
inc eax
dec ecx
jne 0x103dd68c
jmp 0x103dd69f
sbb dword [edi + 0x19], ebx
sbb ebp, dword [esi + 0x13929292]
push ebx
push 0xffffffffffffff92
xchg edx, eax
xchg edx, eax
xchg ecx, eax
pop edi
sub dl, byte [edx + edx*4 - 0x45d76d6e]
xchg edx, eax
xchg edx, eax
xchg edx, eax
jo 0x103dd64d
pop edx
sbb dword [ebx], edx
sahf
xchg edx, eax
xchg edx, eax
xchg edx, eax
xchg ecx, eax
push edi
pop ds
div byte [esi - 0x4969e492]
pop ds
div byte [esi - 0x4969e492]
cli
lcall 0xb7a2, 0xfa929c23
mov ebp, 0xb6be9392
cli
or esi, dword [edi - 1]
cmp byte [edx - 0x69], bh
xchg edx, eax
xchg edx, eax
xchg edx, eax
jnp 0x103dd6a8
xchg edx, eax
xchg edx, eax
xchg edx, eax
pop ds
div byte [esi - 0x4941e492]
invalid
Function at 0x402e82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402e91
pop dword [ebp - 0x38]
mov eax, 0x78fe0efa
sub eax, 0x78bde069
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x1e8a9a1c
add dword [ebp - 0x48], 0x2fc7ab2f
mov dword [ebp - 0x44], 0x80855af9
add dword [ebp - 0x44], 0xb1adf14c
mov dword [ebp - 0x40], 0xd873a28e
sub dword [ebp - 0x40], 0x8c275e60
mov dword [ebp - 0x3c], 0xae42c3ab
sub dword [ebp - 0x3c], 0xae42c3ab
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xaac3c34d
add dword [ebp - 0x48], 0xc9aea609
mov dword [ebp - 0x44], 0xc783c0a6
sub dword [ebp - 0x44], 0x86175f31
mov dword [ebp - 0x40], 0x1272d8b
sub dword [ebp - 0x40], 0x9db7c11f
mov dword [ebp - 0x3c], 0xccba54c4
add dword [ebp - 0x3c], 0x3345ab3c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x2779626f
sub eax, 0x2738e16f
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36f92
push 0
call eax
mov ecx, 0x47ea
xor edi, edi
add edi, eax
mov edx, 0xfa6f8013
add edx, 0x5d583ed
add edx, dword [ebp - 0x38]
mov esi, 0x687a25c2
add dword [ebp - 0x34], 0x3c9b4f24
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x8243dbc3
xor ebx, esi
xor dword [ebp - 0x18], eax
mov dword [edi], ebx
sub dword [ebp - 8], 0xd4b94833
add edi, 0x5b7854d9
add edi, 0xa487ab2b
add edx, 4
loop 0x402fa4
add eax, 0x4ddd8dff
add eax, 0xb223847c
mov ebx, eax
add eax, 0x46be9b91
sub eax, 0x46be9b8c
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x100085e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x100351ec], 0x10008580
mov eax, dword [0x10034e40]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x10008610
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
call fcn.1000aad0
add esp, 4
push 0x34
call fcn.1000f203
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008630
push str.out_of_memory.
call fcn.1000aad0
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
call fcn.1000aad0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10008666
push str.lacks_overlay_support.
call fcn.1000aad0
add esp, 4
xor eax, eax
mov al, byte [0x10030640]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call fcn.1000aad0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x100086a1
push 0x1003096c
call fcn.1000aad0
add esp, 4
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1000aad0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [0x10034cd0]
push eax
call fcn.1000aad0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x70]
and ecx, 0x28030
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 0x5c], 0
je 0x10008723
push 3
push 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x68], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x24], edx
push 1
call fcn.1000aad0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x1000877f
push 0x404
call dword [sym.imp.OPENGL32.dll_glDrawBuffer]
push 0x404
call dword [sym.imp.OPENGL32.dll_glReadBuffer]
mov esp, ebp
pop ebp
ret

Function at 0x10008a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10034e40]
cmp dword [eax + 0x24], 0
jne 0x10008a4d
push str.glutHideOverlay:_window_has_no_overlay_established
call fcn.1000aad0
add esp, 4
jmp 0x10008a72
push 0
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x10034e40]
mov edx, dword [ecx + 0x24]
mov dword [edx + 0x20], 0
pop ebp
ret
Function at 0x1000aad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000aadf
pop dword [ebp - 0x28]
mov eax, 0x4bce1185
sub eax, 0x3bcd66a6
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x39a6a
push 0
mov eax, 0xc8c87028
sub eax, 0xb8c6ef38
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4712
xor edi, edi
add edi, eax
mov esi, 0xe3846df4
sub esi, 0xd380adf4
add esi, dword [ebp - 0x28]
mov ebx, 0xe0c29783
sub ebx, 0xa02081ed
xor dword [ebp - 4], 0x5a03d39b
mov edx, dword [esi]
add dword [ebp - 0x10], edx
sub edx, ebx
mov dword [ebp - 0x10], 0x67449086
mov dword [edi], edx
mov dword [ebp - 4], 0xe64cd1a0
add edi, 0x3ffe717c
add edi, 0xc0018e88
add esi, 0x84557974
sub esi, 0x84557970
loop 0x1000ab3a
add eax, 0x9aa2508c
add eax, 0x655ebe8f
mov ebx, eax
add eax, 0x773885c9
sub eax, 0x773885c4
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40633c
pop dword [ebp - 0x44]
mov eax, 0x40633c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc0b70de0
add dword [ebp - 0x54], 0x8d9b376b
mov dword [ebp - 0x50], 0x85ae7c06
sub dword [ebp - 0x50], 0x537b2fc1
mov dword [ebp - 0x4c], 0xd31beda3
add dword [ebp - 0x4c], 0x7930568b
mov dword [ebp - 0x48], 0x8bd9e315
sub dword [ebp - 0x48], 0x8bd9e315
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4d527277
add eax, 0xb2edfde9
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc36bd7c
add dword [ebp - 0x54], 0x683babda
mov dword [ebp - 0x50], 0xc8902ae8
sub dword [ebp - 0x50], 0x8723c973
mov dword [ebp - 0x4c], 0x62988dd7
sub dword [ebp - 0x4c], 0xff29216b
mov dword [ebp - 0x48], 0xc9c1e1eb
sub dword [ebp - 0x48], 0xc9c1e1eb
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x4918f28a
sub eax, 0x48d8818a
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x34c51
push 0
call eax
mov ecx, 0x41a3c37b
sub ecx, 0x41a382e0
mov edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x44]
mov edi, 0x52b8f052
add dword [ebp - 0x10], ecx
mov esi, dword [ebx]
add dword [ebp - 0x38], ecx
xor esi, edi
sub dword [ebp - 0x34], 0xcefa8e54
mov dword [edx], esi
xor dword [ebp - 0x24], eax
add edx, 0x99d769e7
sub edx, 0x99d769e3
add ebx, 4
loop 0x40644d
add eax, 0xc4e1d4db
add eax, 0x3b1f2064
xor ebx, ebx
add ebx, eax
add eax, 0x8a67b484
add eax, 0x75984b81
mov ecx, 0xbb183153
sub ecx, 0xbad83153
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x401c66
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6ff8ed99
add dword [ebp - 0x50], 0xde5957b2
mov dword [ebp - 0x4c], 0x3ddb4a7b
add dword [ebp - 0x4c], 0xf45801ca
mov dword [ebp - 0x48], 0xe1e5cceb
sub dword [ebp - 0x48], 0x959988bd
mov dword [ebp - 0x44], 0x9efea08d
sub dword [ebp - 0x44], 0x9efea08d
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa6f65ea7
add eax, 0x5949d1ad
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x758b75ef
sub dword [ebp - 0x50], 0x1190c99
mov dword [ebp - 0x4c], 0x33dc15de
add dword [ebp - 0x4c], 0xd904b97
mov dword [ebp - 0x48], 0x30e99d8f
sub dword [ebp - 0x48], 0xcd7a3123
mov dword [ebp - 0x44], 0x97d25cb5
add dword [ebp - 0x44], 0x682da34b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xd50e25ac
sub eax, 0xd4cdf580
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34da6
push 0
call eax
mov ecx, 0x417d
xor esi, esi
add esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x40]
mov ebx, 0xa63b205c
xor dword [ebp - 0x10], ecx
mov edi, dword [edx]
xor dword [ebp - 0x14], 0xe692cf63
add edi, ebx
xor dword [ebp - 0x10], 0x4f3d5a3a
mov dword [esi], edi
sub dword [ebp - 0x2c], 0x6c8b1df6
add esi, 0x8a4ba2b2
sub esi, 0x8a4ba2ae
add edx, 4
loop 0x401d73
add eax, 0x13280fde
add eax, 0xecd8e8e9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x41fa9a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f73c

Function at 0x41faa5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f8cb

Function at 0x41fe9f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040cd00
mov eax, dword [0x483680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041e79f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41fee1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x42003d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042ca60
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x485650]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0042106f
mov ecx, dword [esi*4 + 0x485650]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x420036
cmp eax, dword [edi + ecx + 0x24]
jne 0x420036
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420036
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042106f
add esp, 0x14
test edx, edx
jl 0x420036
jg 0x41ffac
test eax, eax
jb 0x420036
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x420036
jl 0x41ffc6
cmp dword [ebp - 0x1008], eax
ja 0x420036
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41ffe4
test ebx, ebx
je 0x42001d
cmp ecx, edi
jae 0x42001d
mov al, byte [ecx]
cmp al, 0xd
jne 0x41fffe
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42000a
cmp byte [ecx + 1], 0xa
jne 0x42000a
inc ecx
jmp 0x42000a
movzx eax, al
movsx eax, byte [eax + 0x483940]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41ffe4
cmp edx, ebx
jne 0x41ffe4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x42003b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040bf55
leave
ret