joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d41c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x65c
mov eax, 0x47c7be
call fcn.004267c5
mov edi, ecx
mov ebx, 0x208
lea eax, [ebp - 0x628]
push ebx
xor esi, esi
push esi
push eax
call fcn.004558f0
add esp, 0xc
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
push str.249cc
call fcn.0040d687
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
call fcn.0040d7b5
mov ecx, edi
call fcn.0040d36b
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x65c], esi
push eax
push 9
push esi
push str.SYSTEMCurrentControlSet_services_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d498
xor eax, eax
jmp 0x40d681
mov edi, esi
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x664], edi
mov dword [ebp - 0x660], esi
push 0x480574
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], esi
call fcn.00407a3e
push ebx
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 1
push esi
push eax
call fcn.004558f0
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004558f0
lea eax, [ebp - 0x420]
push 0x480424
push eax
call fcn.0046449c
lea eax, [ebp - 0x420]
push eax
call fcn.00464647
add esp, 0x24
lea eax, [ebp - 0x218]
mov ebx, esi
push 0x104
push eax
push esi
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40d5ce
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00407a3e
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
call fcn.00464647
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00455f1d
add esp, 0xc
test eax, eax
je 0x40d597
lea eax, [ebp - 0x640]
push eax
cmp dword [ebp - 0x660], edi
je 0x40d585
mov ecx, edi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
call fcn.0040778e
add edi, 0x18
mov dword [ebp - 0x664], edi
jmp 0x40d597
push edi
lea ecx, [ebp - 0x668]
call fcn.0040d282
mov edi, dword [ebp - 0x664]
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.0040782f
push 0x104
lea eax, [ebp - 0x218]
inc ebx
push eax
push ebx
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x40d522
mov esi, dword [ebp - 0x668]
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d660
push str.SYSTEMCurrentControlSet_services_
lea ecx, [ebp - 0x640]
call fcn.00407a3e
cmp dword [esi + 0x14], 8
mov ebx, esi
mov byte [ebp - 4], 3
jb 0x40d5fd
mov ebx, dword [esi]
push ebx
call fcn.00458389
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x640]
call fcn.00407868
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov ebx, reloc.WS2_32.dll_bind
cmovae eax, dword [ebp - 0x640]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.0040782f
add esi, 0x18
cmp esi, edi
jne 0x40d5df
lea ecx, [ebp - 0x658]
call fcn.0040782f
lea ecx, [ebp - 0x668]
call fcn.004089c5
xor eax, eax
inc eax
call fcn.00426780
ret
Function at 0x40d687
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x47c7f1
call fcn.004267c5
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
push ebx
push eax
call fcn.004558f0
push 0x480424
lea eax, [ebp - 0x218]
push 0x481278
push eax
call fcn.0040a7e5
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.0041f896
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.0041f8ca
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x40d71b
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d7a2
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push 0xf013f
jmp 0x40d743
push 0xf003f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d7a2
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40d76b
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d7a2
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x248]
call fcn.0041f8a9
call fcn.00426780
ret 8

Function at 0x40d7b5
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40d7f9
push 0x10020
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40d80b
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042675a
leave
ret 4
push edi
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
test edi, edi
pop edi
je 0x40d7f9
xor eax, eax
inc eax
jmp 0x40d7fb
Function at 0x40e203
Capabilities:
Check if file exists

Disassembly:
push 0x25c
mov eax, 0x47c998
call fcn.004267c5
mov edi, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004558f0
add esp, 0xc
lea ecx, [ebp - 0x248]
push str.UnKonw
call fcn.00407a3e
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push str.UnKonw
push eax
call fcn.0046440b
pop ecx
pop ecx
test esi, esi
je 0x40e34f
push esi
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0040e88b
push 0x480574
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040ac63
test al, al
je 0x40e2b5
push esi
lea eax, [ebp - 0x260]
mov ecx, edi
push eax
call fcn.0040e92f
push eax
lea ecx, [ebp - 0x230]
call fcn.00407010
lea ecx, [ebp - 0x260]
call fcn.0040782f
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004129c8
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40e2e0
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046440b
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.0040782f
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e340
lea eax, [ebp - 0x248]
push eax
sub esp, 0x18
lea eax, [ebp - 0x230]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040778e
mov ecx, edi
call fcn.0040e390
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0040782f
lea eax, [ebp - 0x218]
push eax
call fcn.00458389
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.0040790f
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x248]
push eax
call fcn.00406ff0
lea ecx, [ebp - 0x248]
call fcn.0040782f
call fcn.00426780
ret 0xc
Function at 0x40e661
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x49f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x480574
mov dword [ebp - 0xa38], ebx
push edi
call fcn.00458389
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.0040790f
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004558f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x40e878
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call ebx
mov esi, eax
test esi, esi
je 0x40e878
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00426af0
mov edi, eax
pop ecx
test edi, edi
je 0x40e878
lea ecx, [esi*2 + 2]
push ecx
push 0
push edi
call fcn.004558f0
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x40e871
mov eax, dword [0x481e90]
mov ebx, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x481e94]
push ebx
mov word [ebp - 8], ax
call fcn.00426af0
mov esi, eax
pop ecx
test esi, esi
je 0x40e871
push ebx
push 0
push esi
call fcn.004558f0
movzx eax, word [edi]
add esp, 0xc
mov ebx, edi
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x40e7b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40e85b
push esi
call fcn.00426af9
push 2
call fcn.00426af0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40e85b
push 2
push 0
push esi
call fcn.004558f0
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40e85b
push esi
call fcn.00458389
push eax
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004646ea
add esp, 0x10
test eax, eax
je 0x40e7f2
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x40e7da
movzx eax, word [ebx]
test ax, ax
je 0x40e85b
jmp 0x40e757
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.004558f0
mov eax, dword [ebp - 0xa34]
lea ecx, [ebp - 0x218]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x48128c
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0040eb39
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00407a3e
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00407010
lea ecx, [ebp - 0xa30]
call fcn.0040782f
push edi
call fcn.00426af9
pop ecx
test esi, esi
je 0x40e86d
push esi
call fcn.00426af9
pop ecx
mov al, 1
jmp 0x40e87a
push edi
call fcn.00426af9
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042675a
leave
ret 8
Function at 0x40e88b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x49f068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], edi
call fcn.004558f0
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40e90f
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40e908
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00407a3e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0042675a
leave
ret 8
Function at 0x40e92f
Capabilities:
Enumerate processes

Disassembly:
push 0x470
mov eax, 0x47ca4b
call fcn.004267c5
mov dword [ebp - 0x478], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
mov edi, 0x480574
mov dword [ebp - 0x47c], esi
push edi
call fcn.00407a3e
xor ebx, ebx
lea eax, [ebp - 0x474]
push 0x22c
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004558f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e994
push edi
mov ecx, esi
call fcn.00407a3e
jmp 0x40eaf6
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40eacd
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00407a3e
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], edi
je 0x40e9f9
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.0040782f
lea eax, [ebp - 0x474]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40e9b6
jmp 0x40eacd
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004558f0
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40eac2
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
call fcn.00458389
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040790f
push 0x480574
lea ecx, [ebp - 0x230]
call fcn.0040ac63
test al, al
je 0x40eabb
mov ecx, dword [ebp - 0x478]
lea eax, [ebp - 0x230]
push eax
push edi
call fcn.0040e661
push 0x480574
lea ecx, [ebp - 0x230]
call fcn.0040ac63
test al, al
je 0x40eabb
lea eax, [ebp - 0x450]
push eax
call fcn.00458389
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040790f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x248]
call fcn.0040782f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, esi
mov byte [ebp - 0x478], al
push dword [ebp - 0x478]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040878e
lea ecx, [ebp - 0x230]
call fcn.0040782f
mov eax, esi
call fcn.00426780
ret 8
Function at 0x40ebd0
Capabilities:
Delete registry value

Disassembly:
push 0x424
mov eax, 0x47cb37
call fcn.004267c5
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004558f0
lea eax, [ebp - 0x218]
push 0x480424
push eax
call fcn.0046449c
lea eax, [ebp - 0x218]
push 0x481ec4
push eax
call fcn.0046440b
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x430]
push eax
call fcn.00413e07
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], esi
call fcn.00413e4e
test eax, eax
jne 0x40ecda
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x428]
push eax
mov ebx, 0xf003f
push ebx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x40ecda
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
push 0x4815f4
push dword [ebp - 0x428]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40eccf
push 0x208
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.004558f0
push 0x481600
push 0x480424
lea eax, [ebp - 0x420]
push 0x48128c
push eax
call fcn.0040a7e5
add esp, 0x1c
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x424]
call edi
push dword [ebp - 0x428]
call edi
xor esi, esi
inc esi
lea ecx, [ebp - 0x430]
call fcn.00413e1c
mov eax, esi
call fcn.00426780
ret
Function at 0x411b93
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x4ac
mov eax, 0x47cfef
call fcn.004267c5
mov esi, dword [ebp + 0x38]
xor eax, eax
lea ecx, [ebp - 0x260]
inc eax
push 0x4805f5
mov dword [ebp - 4], eax
call fcn.00407639
push 0x208
xor ebx, ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004558f0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046440b
lea eax, [ebp - 0x218]
push 0x481264
push eax
call fcn.0046440b
add esp, 0x1c
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x411df8
test byte [ebp - 0x4b0], 0x10
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x230]
push eax
je 0x411d25
call fcn.00407a3e
push 0x4833e0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.0040ac63
test al, al
jne 0x411dcc
push 0x4833e4
lea ecx, [ebp - 0x230]
call fcn.0040ac63
test al, al
jne 0x411dcc
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.0040778e
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 4
call fcn.00407868
push 0x48066c
call fcn.00458389
pop ecx
push eax
push 0x48066c
lea ecx, [ebp - 0x248]
call fcn.00407868
cmp dword [ebp + 0x3c], 0
jne 0x411dc1
push ebx
push ebx
push esi
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
mov dword [ebp - 0x4b4], esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040778e
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
lea eax, [ebp - 0x248]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040778e
mov byte [ebp - 4], 4
call fcn.00411b93
add esp, 0x3c
jmp 0x411dc1
call fcn.00407a3e
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
push ebx
cmovae eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x230]
push eax
mov byte [ebp - 4], 6
call fcn.004087e6
cmp eax, 0xffffffff
mov ecx, ebx
push 1
pop eax
cmovne ecx, eax
test ecx, ecx
je 0x411dcc
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.0040778e
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 8
call fcn.00407868
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x411db2
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.0040f581
jmp 0x411dc1
lea ecx, [ebp - 0x248]
push ecx
push eax
mov ecx, esi
call fcn.0040d282
lea ecx, [ebp - 0x248]
call fcn.0040782f
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040782f
lea eax, [ebp - 0x4b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411c1e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x260]
call fcn.00407809
lea ecx, [ebp + 8]
call fcn.0040782f
lea ecx, [ebp + 0x20]
call fcn.0040782f
call fcn.00426780
ret
Function at 0x411e19
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xc4
mov eax, 0x47d037
call fcn.004267c5
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov edi, 0x480574
lea ecx, [ebp - 0x28]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00407a3e
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.00420c31
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411f5c
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x411ea3
push edi
mov ecx, esi
call fcn.00407a3e
jmp 0x411f79
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xcc], eax
inc eax
push eax
mov dword [ebp - 0xc8], eax
call fcn.00426af0
mov edi, eax
pop ecx
test edi, edi
jne 0x411ecd
push 0x480574
jmp 0x411e97
push dword [ebp - 0xc8]
push 0
push edi
call fcn.004558f0
add esp, 0xc
lea eax, [ebp - 0xd0]
push 0
push eax
push dword [ebp - 0xcc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xc4]
push edi
call fcn.004215d8
push edi
call fcn.00426af9
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00420e2c
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.00410229
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00407809
cmp dword [ebp - 0x30], 0
jbe 0x411f52
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406ff0
lea ecx, [ebp - 0x40]
call fcn.0040782f
xor ebx, ebx
mov byte [ebp - 0xc8], bl
lea eax, [ebp - 0x28]
push dword [ebp - 0xc8]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.0040878e
lea ecx, [ebp - 0x28]
call fcn.0040782f
lea ecx, [ebp + 0xc]
call fcn.0040782f
mov eax, esi
call fcn.00426780
ret

Function at 0x412d4d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push str.337ff0efabed8556b9a9860eda2ec45a
mov dword [ebp - 4], esi
call fcn.004584b0
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, esi
test edi, edi
je 0x412d88
mov al, byte [esi + str.337ff0efabed8556b9a9860eda2ec45a]
xor byte [ecx + ebx], al
inc esi
xor eax, eax
cmp esi, edx
cmovge esi, eax
inc ecx
cmp ecx, edi
jb 0x412d72
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.00401090
test eax, eax
je 0x412daa
mov edx, dword [ebp - 4]
test edx, edx
je 0x412daa
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x412db4
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412ec7
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.00426b00
mov eax, dword [0x49f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.004558f0
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.00465f13
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.004558f0
push 0x480424
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.0041104f
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004558f0
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.004558f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00458389
pop ecx
test eax, eax
je 0x413126
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004565f3
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x413126
lea eax, [ebp - 0x20c]
push eax
call fcn.00458389
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00465f13
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.0041104f
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.004073f0
push esi
call fcn.0045ccd8
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.00466201
add esp, 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x413126
lea ecx, [ebp - 0x1024]
push ecx
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00412de3
xor eax, eax
add esp, 0x28
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call ebx
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x483498
push eax
cmovne esi, ebx
call fcn.00464dd9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x413126
test esi, esi
jne 0x4130cc
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.00465b69
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.00458389
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.00465b69
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.00465b69
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.00465b69
push edi
call fcn.00465005
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042675a
leave
ret