joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67fe64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
dec edx
test edx, edx
jl 0x67fe84
inc edx
mov ebx, ecx
xor bl, byte [eax]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x6c974c]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
jne 0x67fe6b
mov eax, ecx
pop ebx
ret

Function at 0x69f220
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x753a08], 0
jne 0x69f237
call fcn.0069f1dc
mov eax, edi
dec eax
test eax, eax
jl 0x69f25f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x753608]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x69f241
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6a2284
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6a22b5
dec al
je 0x6a22f0
dec al
je 0x6a2334
dec al
je 0x6a23a6
jmp 0x6a2441
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6a2441
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6a22c5
jmp 0x6a2441
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a2441
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6a2300
jmp 0x6a2441
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a2441
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6a2367
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6a237c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6a2394
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6a2344
jmp 0x6a2441
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a2441
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6a240d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0069f268
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6a23c2
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40121c
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, 0xa
push esp
call sub.KERNEL32.DLL_ReadFile
test byte [esp + 0x2c], 1
je 0x401237
movzx ebx, word [esp + 0x30]
mov eax, ebx
add esp, 0x44
pop ebx
ret

Function at 0x401280
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebx
push esi
mov esi, 0x41944c
cmp dword [esi], 0
jne 0x4012c6
push 0x644
push 0
call sub.KERNEL32.DLL_TransactNamedPipe
mov ecx, eax
test ecx, ecx
jne 0x4012a3
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x419448]
mov dword [ecx], eax
mov dword [0x419448], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x4012b2
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x40190c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x4019c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x419430
call sub.KERNEL32.DLL_VirtualQuery
cmp byte [0x419041], 0
je 0x40193a
push 0x419430
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov eax, 0x419450
call fcn.004012d0
mov eax, 0x419460
call fcn.004012d0
mov eax, 0x41948c
call fcn.004012d0
push 0xff8
push 0
call sub.KERNEL32.DLL_TransactNamedPipe
mov dword [0x419488], eax
cmp dword [0x419488], 0
je 0x4019a1
mov eax, 3
mov edx, dword [0x419488]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401977
mov eax, 0x419470
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x41947c], eax
mov byte [0x419428], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4019c9
cmp byte [0x419041], 0
je 0x4019c1
push 0x419430
call sub.KERNEL32.DLL_WaitForSingleObject
ret

Function at 0x4019d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x419428], 0
je 0x401aad
xor edx, edx
push ebp
push 0x401aa6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x419041], 0
je 0x401a02
push 0x419430
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov byte [0x419428], 0
mov eax, dword [0x419488]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
xor eax, eax
mov dword [0x419488], eax
mov ebx, dword [0x419450]
jmp 0x401a35
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualLock
mov ebx, dword [ebx]
cmp ebx, 0x419450
jne 0x401a23
mov eax, 0x419450
call fcn.004012d0
mov eax, 0x419460
call fcn.004012d0
mov eax, 0x41948c
call fcn.004012d0
mov eax, dword [0x419448]
test eax, eax
je 0x401a7b
mov edx, dword [eax]
mov dword [0x419448], edx
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, dword [0x419448]
test eax, eax
jne 0x401a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401aad
cmp byte [0x419041], 0
je 0x401a9b
push 0x419430
call sub.KERNEL32.DLL_WaitForSingleObject
push 0x419430
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret

Function at 0x4025a0
Capabilities:
Get common file path

Disassembly:
test eax, eax
je 0x4025ae
call dword [0x417018]
or eax, eax
je 0x4025af
ret
mov al, 1
jmp fcn.00402620
Function at 0x4025b8
Capabilities:
Get common file path

Disassembly:
test eax, eax
je 0x4025c6
call dword [0x41701c]
or eax, eax
jne 0x4025c7
ret
mov al, 2
jmp fcn.00402620

Function at 0x4025d0
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402608
test edx, edx
je 0x4025f2
push eax
mov eax, ecx
call dword [0x417020]
pop ecx
or eax, eax
je 0x402601
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402620
mov dword [eax], edx
mov eax, ecx
call dword [0x41701c]
or eax, eax
jne 0x4025eb
ret
mov al, 1
jmp fcn.00402620
test edx, edx
je 0x40261c
push eax
mov eax, edx
call dword [0x417018]
pop ecx
or eax, eax
je 0x402601
mov dword [ecx], eax
ret

Function at 0x402620
Capabilities:
Get common file path

Disassembly:
and eax, 0x7f
mov ecx, dword [0x419004]
test ecx, ecx
je 0x402630
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402649]
jns 0x402644
call fcn.00405d24
mov eax, dword [eax + 4]
jmp fcn.00403444

Function at 0x402664
Capabilities:
Get common file path

Disassembly:
push eax
push edx
push ecx
call fcn.00405d24
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x402679
ret
xor eax, eax
jmp fcn.00402620

Function at 0x4028f8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x41903c], 0x8088405
inc edx
mov dword [0x41903c], edx
mul edx
mov eax, edx
ret

Function at 0x402c10
Capabilities:
Get common file path

Disassembly:
cmp dword [0x419018], 0
je 0x40287f
call dword [0x419018]
mov eax, 0xd2
jmp fcn.00403444
push eax
push ecx
mov eax, dword [eax]
call fcn.00402be0
pop ecx
pop eax
je 0x402c1f
jmp ebx
pop ecx
jmp 0x402870

Function at 0x403318
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x41949c
mov esi, 0x419030
mov edi, 0x419034
cmp byte [ebx + 0x24], 0
jne 0x403347
cmp dword [edi], 0
je 0x403347
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403336
cmp dword [0x419038], 0
je 0x403397
call fcn.00403294
cmp byte [0x419040], 0
je 0x403374
mov edx, 0x417024
mov eax, 0x419214
call fcn.004055c0
call fcn.00405543
jmp 0x403390
cmp byte [0x41700c], 0
jne 0x403390
push 0
push 0x417044
push 0x417024
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
mov dword [0x419038], eax
cmp byte [ebx + 0x24], 2
jne 0x4033a7
cmp dword [esi], 0
jne 0x4033a7
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403168
cmp byte [ebx + 0x24], 1
jbe 0x4033b7
cmp dword [esi], 0
je 0x4033d4
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4033d4
call fcn.00404c24
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4033d4
push edx
call sub.KERNEL32.DLL_LeaveCriticalSection
call fcn.00403140
cmp byte [ebx + 0x24], 1
jne 0x4033e2
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4033ed
call fcn.004032e4
cmp dword [ebx], 0
jne 0x4033fa
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403397

Function at 0x403444
Capabilities:
Get common file path

Disassembly:
pop dword [0x419038]
jmp fcn.00403438
Function at 0x403b98
Capabilities:
Get common file path

Disassembly:
mov al, 1
jmp fcn.00402620
test edx, edx
je fcn.00403b5c
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403b5c
push ecx
push edx
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403b54
ret

Function at 0x403be8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x403c27
cmp al, 0xb
je 0x403c27
cmp al, 0xc
je 0x403c31
cmp al, 0xd
je 0x403c44
cmp al, 0xe
je 0x403c62
cmp al, 0xf
je 0x403c27
cmp al, 0x11
je 0x403c27
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402620
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x403c27
jmp 0x403c76
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x403c31
jmp 0x403c76
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x403be8
dec edi
jg 0x403c47
pop ebp
jmp 0x403c76
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403bbc
dec edi
jg 0x403c65
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x403be8

Function at 0x403c7c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x403c27
cmp al, 0xb
je 0x403c27
cmp al, 0xc
je 0x403c31
cmp al, 0xd
je 0x403c44
cmp al, 0xe
je 0x403c62
cmp al, 0xf
je 0x403c27
cmp al, 0x11
je 0x403c27
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402620
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x403c27
jmp 0x403c76
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x403c31
jmp 0x403c76
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x403be8
dec edi
jg 0x403c47
pop ebp
jmp 0x403c76
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403bbc
dec edi
jg 0x403c65
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x403be8
Function at 0x403cb4
Capabilities:
Get common file path

Disassembly:
cmp ecx, 0
je 0x403d9a
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x403d04
cmp al, 0xb
je 0x403d1e
cmp al, 0xc
je 0x403d35
cmp al, 0xd
je 0x403d44
cmp al, 0xe
je 0x403d62
cmp al, 0xf
je 0x403d78
cmp al, 0x11
je 0x403d87
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402620
cmp ecx, 1
mov eax, ebx
jg 0x403d15
call fcn.004034cc
jmp 0x403d96
mov edx, ecx
call fcn.004034f0
jmp 0x403d96
cmp ecx, 1
mov eax, ebx
jg 0x403d2c
call fcn.00403b5c
jmp 0x403d96
mov edx, ecx
call fcn.00403b74
jmp 0x403d96
mov eax, ebx
add ebx, 0x10
call fcn.004044cc
dec edi
jg 0x403d35
jmp 0x403d96
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00403cb4
dec edi
jg 0x403d47
pop ebp
jmp 0x403d96
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403c88
dec edi
jg 0x403d65
pop ebp
jmp 0x403d96
mov eax, ebx
add ebx, 4
call fcn.00404cec
dec edi
jg 0x403d78
jmp 0x403d96
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004046c0
dec edi
jg 0x403d87
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x403d9c
Capabilities:
Get common file path

Disassembly:
mov ecx, 1
jmp fcn.00403cb4

Function at 0x403da8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x403dd4
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004026b8
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x403e13
cmp cl, 0xb
je 0x403e24
cmp cl, 0xc
je 0x403e35
cmp cl, 0xd
je 0x403e46
cmp cl, 0xe
je 0x403e66
cmp cl, 0xf
je 0x403e7f
cmp cl, 0x11
je 0x403e90
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402620
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403520
mov eax, 4
jmp 0x403ea1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403b98
mov eax, 4
jmp 0x403ea1
lea edx, [esi + eax]
add eax, ebx
call fcn.00404188
mov eax, 0x10
jmp 0x403ea1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00403ec4
pop eax
jmp 0x403ea1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00403da8
pop eax
jmp 0x403ea1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404d04
mov eax, 4
jmp 0x403ea1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004046fc
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x403dc2
pop ecx
sub ecx, eax
jle 0x403ebd
lea edx, [ebx + eax]
add eax, esi
call fcn.004026b8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403ec4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x403f0a
cmp cl, 0xb
je 0x403f21
cmp cl, 0xc
je 0x403f35
cmp cl, 0xd
je 0x403f49
cmp cl, 0xe
je 0x403f6a
cmp cl, 0xf
je 0x403f87
cmp cl, 0x11
je 0x403f9b
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402620
mov eax, ebx
mov edx, dword [esi]
call fcn.00403520
add ebx, 4
add esi, 4
dec ebp
jne 0x403f0a
jmp 0x403faf
mov eax, ebx
mov edx, dword [esi]
call fcn.00403b98
add ebx, 4
add esi, 4
dec ebp
jne 0x403f21
jmp 0x403faf
mov eax, ebx
mov edx, esi
call fcn.00404188
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x403f35
jmp 0x403faf
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00403ec4
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x403f52
jmp 0x403faf
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00403da8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x403f6a
jmp 0x403faf
mov eax, ebx
mov edx, dword [esi]
call fcn.00404d04
add ebx, 4
add esi, 4
dec ebp
jne 0x403f87
jmp 0x403faf
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.004046fc
add ebx, 4
add esi, 4
dec ebp
jne 0x403f9b
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x404188
Capabilities:
Get common file path

Disassembly:
mov al, 0x10
jmp fcn.00402620
cmp eax, edx
je 0x404220
cmp word [eax], 8
jb 0x4041c0
push eax
push edx
cmp word [eax], 0x100
je 0x4041b6
cmp word [eax], 0x101
je 0x4041ae
push eax
call sub.user32.dll_DestroyWindow
jmp 0x4041be
call dword [0x4193e0]
jmp 0x4041be
add eax, 8
call fcn.004034cc
pop edx
pop eax
cmp word [edx], 8
jae 0x4041d7
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4041f2
cmp word [edx], 0x101
jne 0x40420c
push eax
call 0x4041c6
pop eax
jmp dword [0x4193e8]
mov edx, dword [edx + 8]
or edx, edx
je 0x404203
mov ecx, dword [edx - 8]
inc ecx
jle 0x404203
lock inc dword [edx - 8]
mov word [eax], 0x100
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.user32.dll_DispatchMessageA
or eax, eax
jne 0x40413c
ret
Function at 0x4042a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ax, word [ebx]
sub ax, 0x100
je 0x4042c7
dec ax
je 0x404311
jmp 0x40431e
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.00404290
test al, al
jne 0x404345
mov word [ebp - 0x10], 0
push edi
push 0
push 0x400
push esi
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4042f7
call fcn.00404134
mov eax, ebx
call fcn.00404144
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
jmp 0x404345
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.00404224
jmp 0x404345
mov edx, esi
mov eax, ebx
mov ecx, edi
call fcn.00404290
test al, al
jne 0x404345
push edi
push 0
push 0x400
push esi
push ebx
call sub.user32.dll_EnumWindows
test eax, eax
je 0x404345
call fcn.00404134
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404784
Capabilities:
Clear file content
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x404908
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
test ebx, ebx
je 0x4047e9
push 0x404918
push ebx
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4047e9
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0xc]
test eax, eax
je 0x4047e9
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x4048fe
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x404829
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x4048fe
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00404770
mov ebx, eax
cmp byte [ebx], 0
je 0x4048fe
lea eax, [ebx + 1]
call fcn.00404770
mov ebx, eax
cmp byte [ebx], 0
je 0x4048fe
jmp 0x40482f
mov ebx, dword [ebp - 4]
add ebx, 2
mov esi, ebx
sub esi, dword [ebp - 4]
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetEvent
jmp 0x4048e5
lea eax, [ebx + 1]
call fcn.00404770
mov edi, eax
mov eax, edi
sub eax, ebx
mov edx, eax
add edx, esi
inc edx
cmp edx, 0x105
jg 0x4048fe
inc eax
push eax
push ebx
lea eax, [ebp - 0x24f]
add eax, esi
push eax
call sub.KERNEL32.DLL_SetEvent
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_IsBadReadPtr
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4048fe
push ebx
call sub.KERNEL32.DLL_InitializeCriticalSection
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea edx, [esi + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x4048fe
mov byte [ebp + esi - 0x24f], 0x5c
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, esi
inc eax
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
inc eax
add esi, eax
mov ebx, edi
cmp byte [ebx], 0
jne 0x40484d
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40492c
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_MapViewOfFile
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ae8
push 0x80000001
call sub.user32.dll_GetWindowThreadProcessId
test eax, eax
je 0x40498d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404b04
push 0x80000001
call sub.user32.dll_GetWindowThreadProcessId
test eax, eax
jne 0x4049ff
xor eax, eax
push ebp
push 0x4049f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404784
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_LoadStringA
test eax, eax
je 0x4049e1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404b24
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_LoadStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049ff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetSystemMetrics
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ReadProcessMemory
push eax
call sub.KERNEL32.DLL_LocalFree
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ae0
cmp byte [ebp - 0xd], 0
jne 0x404a41
cmp byte [ebp - 0x12], 0
je 0x404ae0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404a5a
dec ebx
cmp byte [ebx], 0x2e
je 0x404a69
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404a59
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ae0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404a96
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x404ae0
cmp byte [ebp - 0xd], 0
je 0x404ae0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x404ae0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret