joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468c30
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x468d9c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x468d9c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x468d9c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x468d9c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x468d80
cmp dword [esp + 0x10], 0x378
jne 0x468d80
cmp dword [esp + 0x158], 1
jne 0x468da9
cmp dword [esp + 0x17c], 2
jne 0x468da9
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x55219c
push ecx
call fcn.00474fb3
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
call esi
test eax, eax
jne 0x468d80
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00468de0
test eax, eax
je 0x468d80
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.004688e0
test eax, eax
je 0x468d80
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x468da9
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x468d91
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x468d9c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x468dba
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x468dc5
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x468de0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x468ea1
mov eax, dword [esp + 0x488]
test eax, eax
je 0x468ea1
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x468ea1
cmp dword [esp], 0x378
jne 0x468ea1
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x468ea1
lea edx, [esp + 4]
push edx
call fcn.00468870
add esp, 4
test eax, eax
je 0x468ea1
cmp dword [esp + 0x234], 1
jne 0x468e93
cmp dword [esp + 0x258], 2
jne 0x468e93
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x468ea1
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x468ea1
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x468eb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x468f0f
push esi
call fcn.00468870
add esp, 4
test eax, eax
je 0x468f0f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x468f0f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x468f0f
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x468fa0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x468fd4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00468eb0
test eax, eax
jne 0x468fed
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00468f20
cmp eax, 1
je 0x46917a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x469026
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x4690a2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x469122
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00468de0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x469139
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x469042
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4690f0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00468a90
test eax, eax
je 0x469122
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x4690be
cmp dword [esp + 0x18], 1
jb 0x469122
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00468970
cmp eax, 1
je 0x46916b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x469149
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x469122
push ebp
mov ecx, ebx
call fcn.00469190
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46917a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x469190
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x4691c2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00468f20
test eax, eax
jne 0x4691df
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x469206
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x469254
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00468c30
test eax, eax
jne 0x46923d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x469223
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.00468a00
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x469277
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x46ed50
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46edf3
test eax, eax
jbe 0x46edf3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46edf3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46ed9e
xor esi, esi
jmp 0x46eda4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46edcf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004708d0
add esi, eax
push esi
mov ebx, esi
call fcn.004708d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46edb0
pop ebp
test edi, edi
pop edi
jne 0x46edf3
test ebx, ebx
je 0x46edf3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00473df0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x46ef15
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46f02d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46f02d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00485443
mov esi, eax
test esi, esi
je 0x46f02d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46f02d
mov ecx, esi
call fcn.0046eea0
cmp edi, eax
jge 0x46f02d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46efb3
mov dword [esp + 0x34], 1
jmp 0x46f00e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46f02d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046d720
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x485de7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x485e1f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00483e9b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00483e73
jmp 0x485e2b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4874d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x487517
call fcn.0048cf89
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x487517
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48750e
xor eax, eax
jmp 0x48751f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00487525
pop edi
pop esi
pop ebx
ret 4
Function at 0x48d4b9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48d4e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48d505
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048d41f
jmp 0x48d505
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48d505
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048d41f
test edi, edi
mov eax, edi
jne 0x48d4ef
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1001529
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10015a0
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001588
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1001590
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10017cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
cmp dword [ebp - 8], 0xd2af9
sete bl
jmp 0x100157f

Function at 0x1001630
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 1
je 0x1001667
push 0x10017c0
push dword [ebp + 8]
call fcn.010015ca
test eax, eax
pop ecx
pop ecx
jne 0x10017dc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x1001730
push 0x80000001
call esi
test eax, eax
jne 0x10016d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x100178c
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10016c0
cmp dword [ebp - 0x10], 4
jne 0x10016c0
cmp dword [ebp - 0x14], 1
je 0x10017e3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
mov dword [ebp - 8], ebx
je 0x1001723
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x100175c
push 0x80000002
call esi
test eax, eax
jne 0x1001723
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10017a8
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100171a
cmp dword [ebp - 0x10], esi
jne 0x100171a
cmp dword [ebp - 0x14], 1
jne 0x100171a
mov byte [ebp - 1], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 4
xor al, al
jmp 0x1001728
mov byte [ebp - 1], bl
jmp 0x10016c0

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x405bf7
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405ef2
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405c2b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7d13c8], eax
jmp 0x405e0a
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405c49
test eax, eax
je 0x405d8e
test byte [ebp + 0xc], 2
je 0x405d8e
mov esi, 0x7bbd10
push edi
push esi
call fcn.0040630d
test ebx, ebx
je 0x405c66
push 0x40a9f4
push esi
call fcn.00406330
jmp 0x405c6c
push edi
call fcn.00405e57
push 0x40a268
push edi
call fcn.00406330
push edi
call fcn.00406323
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405d84
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405e3b
cmp byte [eax], 0
je 0x405cbd
cmp byte [ebp - 0x18], 0
je 0x405cbd
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405cd5
mov al, byte [esi + 1]
cmp al, 0x2e
je 0x405d63
test al, al
je 0x405d63
push esi
push ebx
call fcn.0040630d
test byte [ebp - 0x148], 0x10
je 0x405cfa
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405d63
push dword [ebp + 0xc]
push edi
call fcn.00405bf7
jmp 0x405d63
push edi
push 0x40a9d8
call fcn.00406799
mov eax, dword [ebp - 0x148]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405d5b
test byte [ebp + 0xc], 4
push edi
je 0x405d47
push 0x40a9b4
call fcn.00406799
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405606
push 0
push edi
call fcn.00406054
jmp 0x405d63
push 0x40a994
call fcn.00406799
inc dword [0x7d13c8]
pop ecx
pop ecx
jmp 0x405d63
push edi
push 0xfffffffffffffff2
call fcn.00405606
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405d8e
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405e0a
cmp dword [ebp - 8], esi
push edi
jne 0x405db0
push 0x40a968
call fcn.00406799
inc dword [0x7d13c8]
pop ecx
pop ecx
jmp 0x405e0a
call fcn.004067b5
test eax, eax
je 0x405e0a
push edi
call fcn.00405e10
push edi
push 0x40a948
call fcn.00406799
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405e02
test byte [ebp + 0xc], 4
push edi
je 0x405dfb
push 0x40a920
call fcn.00406799
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405606
push esi
push edi
call fcn.00406054
jmp 0x405e0a
push 0x40a8fc
jmp 0x405da1
push edi
push 0xffffffffffffffe5
call fcn.00405606
pop edi
pop esi
leave
ret 8
Function at 0x406054
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40aa24
push 0x40a87c
call fcn.004067f3
test eax, eax
mov esi, dword [esp + 0x18]
je 0x406080
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4061c6
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7c0698], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x7c0698
je 0x4060c4
push 1
push 0
push esi
call fcn.00405fdc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4061cc
cmp eax, edi
jg 0x4061cc
mov esi, 0x7c0110
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4061cc
cmp eax, edi
jg 0x4061cc
push esi
push ebp
push 0x40aa1c
push 0x7bfd10
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x40aa0c
push esi
call fcn.00406330
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4061c6
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4061bf
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4061bf
cmp edi, dword [esp + 0x18]
jne 0x4061bf
push 0x40aa00
push esi
call fcn.00405f6a
test eax, eax
jne 0x4061d3
lea eax, [esi + edi]
push 0x40aa00
push eax
call fcn.0040630d
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x7bfd10
push eax
call fcn.00405fb6
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7d13d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9fc
push eax
call fcn.00405f6a
test eax, eax
je 0x40618a
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x4061fc
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x4061ef
sub eax, esi
jmp 0x40618c
Function at 0x4039dd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
and dword [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
call fcn.004030bd
mov ebp, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
add ebp, 0x23f
mov edi, dword [esi + 8]
push 0x20
mov dword [esp + 0x28], eax
pop esi
mov dword [esp + 0x1c], 2
add dword [esp + 0x1c], 3
mov edx, dword [esp + 0x18]
mov eax, edx
shl eax, 4
add eax, edi
mov dword [esp + 0x20], 0xedeb2e40
cmp dword [0x6935e4], 0xfa9
mov dword [esp + 0x10], eax
lea ecx, [edx + ebp]
mov eax, dword [0x693628]
cmove eax, dword [esp + 0x20]
and dword [esp + 0x20], 0
cmp dword [0x6935e4], 0x3eb
mov dword [0x693628], eax
mov eax, dword [0x693630]
cmove eax, dword [esp + 0x20]
mov dword [0x693630], eax
mov eax, dword [esp + 0x18]
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x24]
xor eax, ecx
mov dword [0x69362c], 0xf4ea3dee
xor eax, dword [esp + 0x10]
sub ebx, eax
mov dword [esp + 0x14], eax
mov eax, ebx
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
mov eax, ebx
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], eax
lea eax, [ebx + ebp]
xor eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
lea ebp, [ebp + 0x61c88647]
dec esi
jne 0x403a27
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret