joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [0x4217fc]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x364], eax
xor eax, eax
test ebx, ebx
mov ecx, 0x82
lea edi, [esp + 0x151]
mov byte [esp + 0x150], 0
rep stosd dword es:[edi], eax
je 0x409720
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
test eax, eax
jle 0x409720
push ebx
call esi
cmp eax, 0x209
jbe 0x409615
mov eax, 0x6f
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, ebp
call fcn.0041277f
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0x154]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x409709
lea esp, [esp]
mov edi, 0x41d8a4
lea esi, [esp + 0x3c]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4096d0
mov edi, 0x41d8a0
lea esi, [esp + 0x3c]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4096d0
lea eax, [esp + 0x3c]
push eax
push ebx
lea ecx, [esp + 0x158]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, 0x10
jne 0x4096af
lea edx, [esp + 0x150]
push edx
call fcn.004095a0
add esp, 4
jmp 0x4096d0
push 0x80
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409650
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x409650
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, ebp
call fcn.0041277f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x364]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041277f
mov esp, ebp
pop ebp
ret
Function at 0x40a780
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax - 4]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ebp, ecx
mov ecx, 1
sub ecx, ebx
mov ebx, 0x400
sub edx, ebx
or ecx, edx
push edi
jge 0x40a7af
push ebx
mov ecx, esi
call fcn.00403690
mov edi, dword [esi]
cmp dword [edi - 8], ebx
jge 0x40a7c0
push 0x80070057
call fcn.00403340
mov eax, dword [esi]
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
push edi
push ebx
mov byte [ecx + 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40a825
mov edx, dword [esi]
test edx, edx
jne 0x40a7e4
xor edi, edi
jmp 0x40a7fd
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a7f0
sub eax, edi
mov edi, eax
js 0x40a802
cmp edi, dword [edx - 8]
jle 0x40a80c
push 0x80070057
call fcn.00403340
mov edx, dword [esi]
mov dword [edx - 0xc], edi
mov eax, dword [esi]
push 7
push str.C:Temp
mov ecx, esi
mov byte [edi + eax], 0
call fcn.00403e60
mov edx, dword [esi]
test edx, edx
jne 0x40a82f
xor edi, edi
jmp 0x40a841
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a834
sub eax, edi
mov edi, eax
js 0x40a846
cmp edi, dword [edx - 8]
jle 0x40a850
push 0x80070057
call fcn.00403340
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call edi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x40a875
test al, 0x10
jne 0x40a88b
mov edx, dword [esi]
call fcn.00409740
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
je 0x40a90d
push 0x41d38c
mov ecx, esi
call fcn.0040a290
push 1
push 0x41d38c
mov ecx, esi
call fcn.00403dd0
mov eax, dword [ebp + 0xa4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00403dd0
push 3
push 0x41d900
mov ecx, esi
call fcn.00403dd0
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x40a8f1
mov edx, dword [esi]
push edx
call fcn.004095a0
mov eax, dword [esi]
add esp, 4
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esi]
call fcn.00409740
mov edx, dword [esi]
push 0
push edx
call ebx
mov esi, dword [esi]
push esi
call edi
cmp eax, 0xffffffff
je 0x40a90d
test al, 0x10
jne 0x40a916
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x40ae80
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x422978]
push ebp
push esi
push edi
mov ecx, 0x422978
xor ebp, ebp
call dword [eax + 0xc]
mov edi, eax
add edi, 0x10
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
call fcn.004047c0
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x40aeb8
xor eax, eax
jmp 0x40aec9
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40aec0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00403dd0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x2001f
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b028
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push str.InstallLocation
mov ebp, eax
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b028
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x40af46
cmp eax, 2
jne 0x40b028
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x40b028
lea edx, [esp + 0x14]
push edx
dec eax
push eax
lea ecx, [esp + 0x14]
call fcn.00409e30
push eax
push str.InstallLocation
lea ecx, [esp + 0x2c]
call fcn.00408ec0
test eax, eax
jne 0x40b024
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x40afae
lea ecx, [esp + 0x10]
call fcn.00403a20
lea ecx, [esp + 0xc]
call fcn.00403a20
lea ecx, [esp + 0x20]
call fcn.00409b50
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffffe
push ecx
lea ecx, [esp + 0x10]
call fcn.004039e0
cmp al, 0x5c
lea ecx, [esp + 0xc]
push 0x41d38c
je 0x40afd8
call fcn.00404640
mov edx, dword [esp + 0x24]
push edx
jmp 0x40afe2
call fcn.00404640
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.00404640
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b028
lea ecx, [esp + 0x10]
call fcn.00403a20
lea ecx, [esp + 0xc]
call fcn.00403a20
lea ecx, [esp + 0x20]
call fcn.00409b50
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10
ret 8
mov edi, dword [esp + 0xc]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b042
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b05c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebp, ebp
je 0x40b067
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 8
Function at 0x40c850
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 8
push edi
mov edi, ecx
mov eax, dword [edi + 0x74]
test eax, eax
jne 0x40c86a
call fcn.0040bae0
test eax, eax
je 0x40c8f5
push esi
lea eax, [esp + 8]
push eax
push 0x2001f
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c8d6
mov esi, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push eax
push str.RavDown
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c8d6
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40c8c2
cmp eax, 2
jne 0x40c8d6
mov eax, dword [esp + 8]
test eax, eax
jbe 0x40c8d6
push str.RavDown
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [edi + 0x84]
push 0
push 1
push eax
call fcn.0040d8c0
add esp, 0xc
test esi, esi
je 0x40c8f4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [edi + 0x68]
test eax, eax
pop edi
je 0x40c90d
push 0
push 6
push 0x7e8
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
add esp, 8
ret

Function at 0x40cb30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x10
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x18]
je 0x40cc6c
test esi, esi
je 0x40cc6c
xor eax, eax
lea ebx, [ebx]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x40cb50
mov edx, 1
sub edx, esi
mov dword [esp + 8], edx
mov edx, 2
sub edx, esi
mov dword [esp + 0xc], edx
push edi
xor eax, eax
mov edx, 3
xor edi, edi
sub edx, esi
mov dword [esp + 8], eax
mov ecx, esi
mov dword [esp + 0x14], edx
cdq
idiv ebp
movzx eax, byte [edx + ebx]
movzx edx, byte [ecx]
add eax, edi
add edx, eax
mov edi, edx
and edi, 0x800000ff
jns 0x40cba7
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [edi + esi]
mov al, byte [ecx]
mov byte [ecx], dl
mov byte [edi + esi], al
mov eax, dword [esp + 0xc]
add eax, ecx
cdq
idiv ebp
movzx eax, byte [ecx + 1]
movzx edx, byte [edx + ebx]
add edx, edi
add eax, edx
mov edi, eax
and edi, 0x800000ff
jns 0x40cbd8
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [edi + esi]
mov al, byte [ecx + 1]
mov byte [ecx + 1], dl
mov byte [edi + esi], al
mov eax, dword [esp + 0x10]
add eax, ecx
cdq
idiv ebp
movzx eax, byte [ecx + 2]
movzx edx, byte [edx + ebx]
add edx, edi
add eax, edx
mov edi, eax
and edi, 0x800000ff
jns 0x40cc0b
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [edi + esi]
mov al, byte [ecx + 2]
mov byte [ecx + 2], dl
mov byte [edi + esi], al
mov eax, dword [esp + 0x14]
add eax, ecx
cdq
idiv ebp
movzx eax, byte [ecx + 3]
movzx edx, byte [edx + ebx]
add edx, edi
add eax, edx
mov edi, eax
and edi, 0x800000ff
jns 0x40cc3e
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ecx + 3]
mov dl, byte [edi + esi]
mov byte [ecx + 3], dl
mov byte [edi + esi], al
mov eax, dword [esp + 8]
add eax, 4
add ecx, 4
cmp eax, 0x100
mov dword [esp + 8], eax
jl 0x40cb87
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x10
ret
xor eax, eax
pop ebp
add esp, 0x10
ret
Function at 0x40db60
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4217fc]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebx
push esi
mov esi, dword [esp + 0x118]
push edi
mov dword [esp + 0xc], eax
xor eax, eax
test esi, esi
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 1
stosb byte es:[edi], al
je 0x40dbc6
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x40dbc6
push esi
call edi
cmp eax, 0x104
jbe 0x40dbe0
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0041277f
add esp, 0x10c
ret
push ebp
push 0x103
push esi
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea esp, [esp]
test eax, eax
je 0x40dc81
push 0x5c
push eax
call fcn.00412d4c
mov esi, eax
add esp, 8
test esi, esi
je 0x40dc81
lea eax, [esp + 0x14]
push eax
mov byte [esi], 0
call edi
cmp eax, 0xffffffff
je 0x40dc38
test al, 0x10
jne 0x40dc79
test al, 0x10
jne 0x40dc53
push 0x80
lea ecx, [esp + 0x18]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ebx, eax
jne 0x40dc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40dc79
mov ebx, 1
mov byte [esi], 0x5c
lea eax, [esi + 1]
jmp 0x40dc10
lea edx, [esp + 0x14]
push edx
call edi
cmp eax, 0xffffffff
je 0x40dc91
test al, 0x10
jne 0x40dcd2
test al, 0x10
jne 0x40dcac
push 0x80
lea eax, [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ebx, eax
jne 0x40dcd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40dcd2
mov ebx, 1
mov ecx, dword [esp + 0x118]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0041277f
add esp, 0x10c
ret
Function at 0x40dcf0
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x4217fc]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x114], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
mov dword [esp + 0xc], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd31
sub eax, edx
cmp eax, 0x103
jbe 0x40dd48
push 0x6f
jmp 0x40de10
push 0x103
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0041343d
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.00413064
add esp, 0x14
test eax, eax
je 0x40de0e
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x40dd92
push 0x41d38c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push ebx
call edi
test eax, eax
jne 0x40dda3
push 2
jmp 0x40de10
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40ddc1
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0040db60
add esp, 8
test eax, eax
jne 0x40ddc1
push 0x52
jmp 0x40de10
push esi
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
je 0x40ddd6
push 0x80
push esi
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
test edi, edi
je 0x40ddf7
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x40ddf7
push eax
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.0041277f
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041277f
mov esp, ebp
pop ebp
ret

Function at 0x40de30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
mov edx, dword [esp + 0x48]
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
add esp, 0x3c
ret

Function at 0x40de90
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4217fc]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40dee2
cmp dword [esp + 0x10], 2
jne 0x40dee2
cmp dword [esp + 4], 6
jb 0x40dee2
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0041277f
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0041277f
add esp, 0x98
ret
Function at 0x40e470
Capabilities:
Get file size

Disassembly:
mov al, byte [ecx + 0x38]
test al, al
je 0x40e4bf
cmp dword [ecx + 0x34], 0x10
jb 0x40e482
mov ecx, dword [ecx + 0x20]
jmp 0x40e485
add ecx, 0x20
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
add esi, 0x1800
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
ret
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x40e4d3
mov ecx, dword [ecx + 0x40]
test ecx, ecx
lea eax, [ecx + 0x1800]
jne 0x40e4d8
mov eax, 0x2000
ret
Function at 0x416513
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx + 0x7a0006a5], 0
xor dh, cl
into
adc eax, 0x3d188c62
xor bl, ah
push ebx
push ecx
loop 0x4164d5
mov al, byte [0x30842042]
and al, 0xe2
loop 0x416542
cmp eax, 0x40084607
pop es
je 0x4164de
xchg esp, eax
movsb byte es:[edi], byte [esi]
adc ch, dh
jnp 0x41651e
dec edi
out dx, eax
sub eax, 0xda6df3e6
fiadd dword [eax - 0x600a3fb]
xrelease lock add eax, dword [edi]
pop es
je 0x4164b1
cmc
adc dh, 0x9f
xchg dword [esi + 0x5e3ddf1e], ebx
js 0x4164b9
jg 0x416571
or al, 0xe4
mov dword [0xc17f5526], eax
out 0xfc, eax
or al, 0xc9
mov bl, byte cs:[edx + ebx*4 + 0xfbbd751]
leave
push ecx
lock and esp, dword [ebp - 0x63344e3d]
shl dword [esi - 0x61], 1
dec ecx
push dword [ebx]
mov dh, 0x2e
jmp 0x416550
xor esi, dword [esi + 0x67fbeb2e]
dec edi
sti
call edi
dec edx
cmp eax, 0x902f48a0
dec edi
iretd
aad 0x1f
leave
push esp
stc
cdq
adc cl, byte [ebp - 0xfae5ee0]
jno 0x4165e7
push 0x40c303f8
clc
add eax, ebx
inc eax
test eax, 0x624169f1
cmp bh, byte [eax - 0x47712e1f]
leave
sub cl, cl
xchg dword [edi + 0x2f], ebp
sub bl, byte [ebx + ecx*2 + 0x28a3c239]
loopne 0x41657e
int3
pop ebp
xchg edi, eax
add ah, al
or byte [edi + 0x16d675ce], 0x5d
cld
cmp esi, dword [0xc6f805f9]
mov ecx, 0x62a96044
pop ebp
sbb eax, 0x2cddf550
jbe 0x4165e7
aas
invalid

Function at 0x419aea
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x422d18], ebx
push esi
push edi
jne 0x419b6a
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x419ba5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x422d18], eax
je 0x419ba5
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x422d1c], eax
call esi
cmp dword [0x422b7c], 2
mov dword [0x422d20], eax
jne 0x419b6a
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x422d28], eax
je 0x419b6a
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x422d24], eax
mov eax, dword [0x422d24]
test eax, eax
je 0x419baf
call eax
test eax, eax
je 0x419b96
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x422d28]
test eax, eax
je 0x419b96
test byte [ebp - 8], 1
jne 0x419baf
cmp dword [0x422b88], 4
jb 0x419ba9
or byte [ebp + 0x12], 0x20
jmp 0x419bce
xor eax, eax
jmp 0x419bde
or byte [ebp + 0x12], 4
jmp 0x419bce
mov eax, dword [0x422d1c]
test eax, eax
je 0x419bce
call eax
mov ebx, eax
test ebx, ebx
je 0x419bce
mov eax, dword [0x422d20]
test eax, eax
je 0x419bce
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x422d18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a053
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x41a229
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x422ea0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x41a229
test cl, 0x48
je 0x41a0be
cmp byte [eax + 5], 0xa
je 0x41a0be
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a110
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x41a0f8
call int.00416501
mov dword [eax], 9
call fcn.0041650a
mov dword [eax], esi
jmp 0x41a108
cmp eax, 0x6d
je 0x41a229
push eax
call fcn.00416513
pop ecx
or eax, 0xffffffff
jmp 0x41a22b
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x41a224
test eax, eax
je 0x41a137
cmp byte [ebx], 0xa
jne 0x41a137
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x41a140
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x41a21e
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x41a20e
cmp al, 0xd
je 0x41a172
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x41a200
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x41a18c
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x41a187
add dword [ebp + 0x10], 2
jmp 0x41a1e0
mov dword [ebp + 0x10], eax
jmp 0x41a1fc
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a1b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41a1fc
cmp dword [ebp - 0xc], 0
je 0x41a1fc
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x41a1d5
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x41a1e0
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x41a1ff
cmp ebx, dword [ebp + 0xc]
jne 0x41a1e5
cmp byte [ebp - 1], 0xa
jne 0x41a1e5
mov byte [ebx], 0xa
jmp 0x41a1ff
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b798
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41a200
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x41a156
jmp 0x41a21e
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x41a21e
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x41a22b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret