joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460970
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x460987
add esp, 0xfffffff0
call fcn.0040427c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420bb8
mov eax, dword [0x4c3638]
cmp word [eax + 2], 0
jne 0x4609af
mov eax, dword [0x4c3638]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004624b0
mov eax, dword [0x4c3774]
cmp word [eax + 2], 0
jne 0x4609c9
mov eax, dword [0x4c3774]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004626bc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417288]
call fcn.00403f28
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417288]
call fcn.00403f28
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x417288]
call fcn.00403f28
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x427060]
call fcn.0042f03c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x460b80
mov eax, dword [0x4c349c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f410
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x462d8c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c349c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e8bc
test eax, eax
je 0x460ad0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a014
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e8f0
test eax, eax
je 0x460ae4
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004050a8
mov byte [ebx + 0xd4], 0
push ebx
push 0x462010
call fcn.00421d34
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4c3258]
cmp byte [eax], 0
jne 0x460b35
mov eax, ebx
call fcn.00460cc4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00462f68
mov eax, ebx
call fcn.00463ac8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x460b75
call fcn.004042d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460f44
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c758c]
cmp dword [eax + 0x30], 0
je 0x460fee
cmp dword [ebx + 0x94], 0
jne 0x460fe8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460ed4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460fe8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x460fae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460fe8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419984
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x460fbd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461d08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x461d3d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f28
jmp 0x461d4a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e8c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46314c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4631ba
mov eax, esi
call fcn.0044d348
test al, al
je 0x4631ba
mov eax, dword [ebx + 0x84]
call fcn.0044cfa8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4631ba
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4631ae
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044cfa8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00445390
jmp 0x4631ba
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00462f88
pop esi
pop ebx
ret
Function at 0x495610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49566a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00495600
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00493258
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00492d70
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495671
lea eax, [ebp - 4]
call fcn.00404e38
ret
Function at 0x4a0af0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407e70]
call fcn.0040591c
xor eax, eax
push ebp
push 0x4a0c91
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c285c], 0
jne 0x4a0b4b
mov ecx, dword [0x4c327c]
mov dl, 1
mov eax, dword [0x408484]
call fcn.0040da48
call fcn.004047cc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0040371c
mov eax, ebx
call fcn.004057cc
mov dword [ebp - 0x24], eax
mov esi, 0x4a0ca0
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406a28
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004057dc
test eax, eax
jle 0x4a0c34
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a0c20
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004050a8
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4a0bc6
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004050c0
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4a0bdc
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004050c0
mov eax, dword [ebp - 0x54]
call fcn.004052fc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004050a8
mov eax, dword [ebp - 0x58]
call fcn.004052fc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4a0c22
xor eax, eax
test al, al
je 0x4a0c2d
mov ebx, 0x15
jmp 0x4a0c39
mov ebx, 0x10
jmp 0x4a0c39
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4c285c]
call fcn.004a0974
mov eax, dword [ebp - 4]
call fcn.004a0974
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0c98
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404e5c
lea eax, [ebp - 0xc]
mov edx, dword [0x407e70]
call fcn.004059ec
ret
Function at 0x4aa224
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4aa252
mov eax, ebx
call fcn.004aacd8
cmp dword [ebx + 0x40], 0
je 0x4aa24b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4aa2c3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4aa2b5
cmp dword [ebx + 8], 0
je 0x4aa274
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4aa286
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4aa2b5
cmp dword [ebx + 8], 0
je 0x4aa267
cmp eax, 3
je 0x4aa299
dec eax
jne 0x4aa267
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4aa267
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4aa267
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4aa2e1
cmp dword [ebx + 0x14], 0xcc
je 0x4aa2e1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004aa2ec
pop ebx
ret

Function at 0x4ba820
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4ba8e8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4ba8ec
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4ba8e8
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ba8df
xor eax, eax
push ebp
push 0x4ba8d8
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba8df
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4badc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bae51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4bae68
call fcn.00404e8c
lea eax, [ebp - 4]
mov edx, 0x64
call fcn.00405584
push 0x64
mov eax, dword [ebp - 4]
call fcn.004052fc
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
call fcn.004052fc
call fcn.00409fd8
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405584
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409598
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, 0x4bae7c
call fcn.00405148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bae58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e5c
ret
Function at 0x4bb8b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052ec
xor eax, eax
push ebp
push 0x4bb9dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4bb9f4
call fcn.00404e8c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004052fc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4bb9c6
mov eax, dword [ebp - 8]
call fcn.00402d68
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bb9bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4bb9a6
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4bb9fc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x14], 0
je 0x4bb9a6
push ebx
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
and esi, 0xffff
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0xc]
mov eax, edi
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
and edi, 0xffff
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x4bba08
call fcn.0040aa78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb9c6
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00402d84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb9e3
lea eax, [ebp - 4]
call fcn.00404e38
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402ba0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x406020]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
mov esi, ecx
push edi
mov eax, esi
call fcn.00401a9d
push 0x410
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add esp, 0xc
push 0
push 0
call edi
test eax, eax
jne 0x402c03
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00402d44
add esp, 0x420
ret
cmp eax, 0x208
jae 0x402bea
lea ecx, [esp + 8]
push ecx
push 0x209
call edi
test eax, eax
je 0x402bea
cmp eax, 0x208
jae 0x402bea
lea eax, [esp + 8]
mov word [esp + 0x418], 0
call fcn.00401b69
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00402d44
add esp, 0x420
ret

Function at 0x402d44
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406020]
jne 0x402d4e
repz ret
jmp fcn.004032bd
Function at 0x401608
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
test esi, esi
sete dl
test ebx, ebx
sete al
xor ecx, ecx
or dl, al
jne 0x401727
mov edx, dword [ebp + 0xc]
lea eax, [edx*4 + 0xb]
mov edx, 0xc
mov ecx, edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
cmp dword [ebp + 0x14], eax
jge 0x40168f
push 0x6f
call sub.KERNEL32.DLL_SetLastError
xor ecx, ecx
jmp 0x401727
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.l23lbxfx]
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
mov byte [ecx + 1], al
add ecx, 4
jmp 0x40171f
and eax, 0xf
movzx eax, byte [eax*4 + section.l23lbxfx]
mov byte [ecx + 3], 0x3d
mov byte [ecx + 2], al
mov ecx, esi
jmp 0x40171f
xor edi, edi
cmp edi, dword [ebp + 0xc]
mov ecx, esi
jge 0x40171f
movzx eax, byte [ebx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.l23lbxfx]
mov byte [esi], al
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebx]
sub esi, edi
cmp esi, 1
je 0x401656
mov edx, eax
and edx, 3
shl edx, 4
movzx eax, byte [ebx + 1]
shr al, 4
movzx eax, al
or edx, eax
cmp esi, 2
lea esi, [ecx + 4]
movzx eax, byte [edx + section.l23lbxfx]
mov byte [ecx + 1], al
movzx eax, byte [ebx + 1]
je 0x401676
mov edx, eax
movzx eax, byte [ebx + 2]
and edx, 0xf
add edi, 3
shl edx, 2
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.l23lbxfx]
mov byte [ecx + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
movzx eax, byte [eax + section.l23lbxfx]
mov byte [ecx + 3], al
jmp 0x401691
mov byte [ecx], 0
mov ecx, 1
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401732
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
push 0
push 0xa7
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
sete dl
test eax, eax
sete al
xor ecx, ecx
or dl, al
jne 0x401818
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GetFileSize
push eax
push 0
mov dword [ebp - 0x14], eax
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
test eax, eax
mov edi, eax
je 0x4017b9
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4017c5
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
xor ecx, ecx
jmp 0x401818
mov eax, dword [ebp - 0x14]
mov edx, 0xc
mov ebx, edx
xor edx, edx
lea ecx, [eax*4 + 0xb]
mov eax, ecx
div ebx
lea esi, [eax*4 + 1]
push esi
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
push esi
mov ebx, eax
push eax
push dword [ebp - 0x14]
push edi
call fcn.00401608
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx], eax
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, ebx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4018a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
push 0
call sub.msvcrt.dll_malloc
push 0x40b400
mov esi, eax
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
mov edi, eax
add esp, 0xc
xor eax, eax
test edi, edi
je 0x40191b
jmp 0x4018d7
xor eax, eax
jmp 0x40191b
test byte [edi + 0xc], 0x10
jne 0x401901
inc ebx
push ebx
push esi
call sub.msvcrt.dll_realloc
mov esi, eax
test esi, esi
pop eax
pop edx
je 0x4018d3
push edi
lea eax, [esi + ebx - 1]
push 1
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
jmp 0x4018d7
lea eax, [ebx - 1]
push eax
push esi
call fcn.00401878
push esi
mov ebx, eax
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_fclose
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401924
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
mov byte [ebp - 5], 0
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
mov ebx, eax
sete dl
test eax, eax
sete al
xor ecx, ecx
or dl, al
jne 0x401974
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xfa8da
jae 0x40196a
mov byte [ebp - 5], 1
push ebx
call sub.KERNEL32.DLL_CloseHandle
movzx ecx, byte [ebp - 5]
mov ebx, dword [ebp - 4]
mov eax, ecx
leave
ret
Function at 0x401c80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x98
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov esi, eax
sete dl
cmp eax, 0xffffffff
mov ecx, 1
sete al
or dl, al
jne 0x401e31
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
push 0
push 0
push 0
push 2
push 0
push esi
mov dword [ebp - 0x9c], eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x90], eax
test eax, eax
sete dl
inc eax
sete al
or dl, al
je 0x401d01
push esi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, 2
jmp 0x401e31
push 0
push 0
push 0
push 4
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_MapViewOfFile
test eax, eax
mov edi, eax
jne 0x401d35
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, 3
jmp 0x401e31
mov dword [ebp - 0xa0], 0
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x98], eax
mov eax, dword [edi + 0x64]
cmp dword [ebp - 0xa0], eax
mov dword [ebp - 0x94], eax
jae 0x401e18
mov dword [ebp - 0xa4], 0
push pe_nt_image_headers32
mov ebx, dword [ebp - 0x98]
lea eax, [ebp - 0x8c]
add ebx, dword [ebp - 0xa4]
push 0
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
add esp, 0xc
cmp ebx, dword [ebp - 0x9c]
jae 0x401df9
movzx eax, byte [ebx + edi]
mov byte [ecx + ebp - 0x8c], al
cmp byte [ebx + edi], 0
je 0x401dbb
add ebx, 2
inc ecx
cmp ebx, dword [ebp - 0x9c]
setb dl
cmp ecx, 0x43
setbe al
test dl, al
jne 0x401d93
test ecx, ecx
je 0x401df9
push 0x40b57c
push 0x4100a0
call sub.msvcrt.dll_fopen
mov ebx, eax
test ebx, ebx
pop eax
pop edx
je 0x401e2f
push ebx
lea eax, [ebp - 0x8c]
push eax
call sub.msvcrt.dll_fputs
pop ecx
pop eax
push ebx
push 0x40b57f
call sub.msvcrt.dll_fputs
push ebx
call sub.msvcrt.dll_fclose
add esp, 0xc
inc dword [ebp - 0xa0]
mov eax, dword [ebp - 0x94]
add dword [ebp - 0xa4], 0x44
cmp dword [ebp - 0xa0], eax
jb 0x401d67
push edi
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
xor ecx, ecx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401f3a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x264
cmp dword [ebp + 0xc], 0
setle dl
cmp dword [ebp + 8], 0
sete al
or dl, al
mov byte [ebp - 0x26d], dl
jne 0x40209f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x40209f
push eax
lea ebx, [ebp - 0x12c]
mov edi, ebx
push ebx
call sub.msvcrt.dll_strcpy
movzx eax, byte [ebp - 0x26d]
or ecx, 0xffffffff
cld
pop esi
repne scasb al, byte es:[edi]
pop edi
not ecx
cmp byte [ebp + ecx - 0x12e], 0x5c
je 0x401faa
push 0x40b5a1
push ebx
call sub.msvcrt.dll_strcat
pop eax
pop edx
push 0x40b5a3
xor esi, esi
push ebx
call sub.msvcrt.dll_strcat
push 0x140
lea eax, [ebp - 0x26c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x14
test esi, esi
lea eax, [ebp - 0x26c]
jne 0x401ff8
push eax
lea eax, [ebp - 0x12c]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
cmp eax, 0xffffffff
mov esi, eax
je 0x40209d
test eax, eax
jne 0x402007
jmp 0x40209d
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
je 0x402093
cmp byte [ebp - 0x240], 0x2e
jne 0x402028
movzx eax, byte [ebp - 0x23f]
test al, al
je 0x401fcd
cmp al, 0x2e
jne 0x402028
cmp byte [ebp - 0x23e], 0
je 0x401fcd
push dword [ebp + 8]
lea ebx, [ebp - 0x12c]
mov edi, ebx
push ebx
call sub.KERNEL32.DLL_lstrcpyA
cld
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp byte [ebp + ecx - 0x12e], 0x5c
je 0x40205a
push 0x40b5a1
push ebx
call sub.msvcrt.dll_strcat
pop ecx
pop edi
lea eax, [ebp - 0x240]
lea edi, [ebp - 0x26c]
push eax
push ebx
call sub.msvcrt.dll_strcat
test byte [ebp - 0x26c], 0x10
pop eax
pop edx
je 0x402085
mov eax, dword [ebp + 0xc]
dec eax
push eax
push ebx
call fcn.00401f3a
jmp 0x40208c
push edi
push ebx
call fcn.00401e3c
pop edi
pop eax
jmp 0x401fcd
test esi, esi
je 0x40209d
push esi
call sub.KERNEL32.DLL_FindClose
xor ecx, ecx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4020aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x158]
push ebx
sub esp, 0x158
push eax
push 0x20019
push 0
push 0x40b5a7
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402129
push 0x100
lea ebx, [ebp - 0x154]
push 0
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x15c], 0x100
add esp, 0xc
lea eax, [ebp - 0x15c]
push eax
push ebx
push 0
push 0
push 0
push dword [ebp - 0x158]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 0x158]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [ebp - 0x154], 0
je 0x402129
push ebx
call fcn.00401c80
pop eax
mov ebx, dword [ebp - 4]
leave
ret