joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x5be5a8]
mov edx, dword [0x5be5a4]
push esi
mov esi, eax
mov eax, dword [0x5be5ac]
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
call fcn.004111b0
mov eax, esi
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4117a0
sub eax, ecx
mov edi, eax
mov eax, esi
mov esi, 0x5be6d0
call fcn.00409b10
mov eax, ebx
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4117c0
sub eax, ecx
mov edi, eax
mov eax, ebx
mov esi, 0x5be6ec
call fcn.00409b10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [0x5be724], eax
mov eax, esi
mov dword [0x5be728], ecx
mov dword [0x5be72c], edx
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x411800
sub eax, ecx
mov edi, eax
mov eax, esi
mov esi, 0x5be6b0
call fcn.00409b10
mov eax, dword [ebp + 0xc]
mov dword [0x5be6cc], eax
mov dword [0x5be740], 3
call fcn.004112f0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x5be6a0
push 0x40efa0
push 0
push 0
mov dword [ebp - 0x10], 0
call fcn.00534525
add esp, 0x18
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x411860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0x5be6a0
push 0x4100b0
mov dword [0x5be6a0], 0x5b7664
push 0
mov byte [0x5be730], 1
mov dword [ebp - 4], 0
push 0
mov dword [0x5be740], 9
call fcn.00534525
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x414120
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x110], edi
test edi, edi
jne 0x414151
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414156
push ebx
sub eax, edx
push esi
mov dword [ebp - 0x10c], eax
je 0x414246
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call ebx
cmp eax, 0xffffffff
je 0x414183
test al, 0x10
jne 0x414246
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00535390
xor esi, esi
add esp, 0xc
cmp dword [ebp - 0x10c], esi
jbe 0x41420d
lea ecx, [ebp - 0x108]
sub edi, ecx
lea eax, [ebp + esi - 0x108]
mov cl, byte [edi + eax]
mov byte [eax], cl
cmp cl, 0x5c
je 0x4141c8
cmp cl, 0x2f
jne 0x4141fe
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 1], 0
call ebx
cmp eax, 0xffffffff
je 0x4141de
test al, 0x10
jne 0x4141fe
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4141fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x414233
inc esi
cmp esi, dword [ebp - 0x10c]
jb 0x4141b2
mov edi, dword [ebp - 0x110]
push edi
call ebx
cmp eax, 0xffffffff
je 0x414219
test al, 0x10
jne 0x414246
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x414246
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x414246
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov al, 1
pop edi
call fcn.005320a3
mov esp, ebp
pop ebp
ret

Function at 0x414520
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x414540
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x80
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 1
sete al
pop ebx
ret
Function at 0x414820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x58e08c
lea eax, [ebp - 8]
push esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.00534419
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x414886
push eax
push 1
lea ecx, [ebp - 4]
push 4
push ecx
call fcn.00534b7e
add esp, 0x10
cmp eax, 1
je 0x41487a
push esi
push 0x1e
push 0x5be6a0
call fcn.00414260
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call fcn.005347c7
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x414890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x104]
push ebx
mov edx, str.SOFTWARE_
mov ecx, eax
push esi
mov dword [ebp - 0x110], 0x104
mov esi, 0x100
sub edx, ecx
lea ecx, [esi + 0x7ffffefe]
test ecx, ecx
je 0x4148dc
mov cl, byte [edx + eax]
test cl, cl
je 0x4148dc
mov byte [eax], cl
inc eax
dec esi
jne 0x4148c3
jmp 0x4148e0
test esi, esi
jne 0x4148e1
dec eax
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
lea edx, [ebp - 0x104]
push ecx
push str.nFlavor
mov eax, 0x100
mov ebx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], 0
call fcn.00422220
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, ebx
push 0x58c570
mov eax, 0x100
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], 0
call fcn.00422220
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, ebx
push str.Rappelz
mov eax, 0x100
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], 0
call fcn.00422220
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0xf003f
push 0
push 0x58bd25
push 0
mov ecx, ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
pop ebx
test eax, eax
jne 0x4149e2
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
push edx
push edi
lea eax, [ebp - 0x11c]
push eax
push 0
push str.GamePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4149f2
mov edx, dword [ebp - 0x110]
push edx
push 0
push edi
call fcn.00535390
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.005320a3
mov esp, ebp
pop ebp
ret
Function at 0x417580
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55dca8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x58c578
push eax
lea eax, [ebp - 0x48]
mov esi, ecx
push eax
mov dword [ebp - 0x68], esi
mov ebx, edx
call fcn.0040b1b0
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x48]
mov edi, 0x10
cmp dword [ebp - 0x34], edi
jae 0x4175de
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x417625
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x417625
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x4175ff
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [esi + 0x20]
push eax
push ecx
call fcn.00414260
add esp, 0xc
cmp dword [ebp - 0x34], edi
jb 0x41761e
mov edx, dword [ebp - 0x48]
push edx
call fcn.004310e1
add esp, 4
xor al, al
jmp 0x4176cc
xor esi, esi
push esi
mov eax, ebx
call fcn.00409830
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.0041e360
push 0x58c578
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], 1
call fcn.0040b1b0
add esp, 0x10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x417661
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x417677
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4176ea
cmp dword [ebp - 0x18], edi
jb 0x417688
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004310e1
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x50], edi
jb 0x4176af
mov eax, dword [ebp - 0x64]
push eax
call fcn.004310e1
add esp, 4
inc esi
cmp esi, 8
jl 0x417627
cmp dword [ebp - 0x34], edi
jb 0x4176ca
mov eax, dword [ebp - 0x48]
push eax
call fcn.004310e1
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x4176f5
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx + 0x20]
push eax
push edx
call fcn.00414260
add esp, 0xc
cmp dword [ebp - 0x18], edi
jb 0x417717
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004310e1
add esp, 4
xor esi, esi
mov ebx, 0xf
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x50], edi
jb 0x417739
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.004310e1
add esp, 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], esi
mov byte [ebp - 0x64], 0
jmp 0x41760d
Function at 0x417750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d580
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str..new
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040b1b0
add esp, 0xc
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x48]
mov edi, 0x10
cmp dword [ebp - 0x34], edi
jae 0x4177a4
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4177b0
push esi
mov eax, ebx
call fcn.00409830
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.0041e360
push str..new
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov byte [ebp - 4], 1
call fcn.0040b1b0
mov eax, dword [ebp - 0x2c]
add esp, 0x10
cmp dword [ebp - 0x18], edi
jae 0x4177e6
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x18], edi
jb 0x4177fe
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004310e1
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x50], edi
jb 0x417825
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.004310e1
add esp, 4
inc esi
cmp esi, 8
jl 0x4177b0
cmp dword [ebp - 0x34], edi
jb 0x41783c
mov edx, dword [ebp - 0x48]
push edx
call fcn.004310e1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret 4
Function at 0x417860
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d540
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push 0x58c578
lea ecx, [ebp - 0x64]
push esi
push ecx
mov dword [ebp - 0x68], eax
call fcn.0040b1b0
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
mov edi, 0x10
cmp dword [ebp - 0x50], edi
jae 0x4178bb
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4178f3
cmp dword [esi + 0x14], edi
jb 0x4178d0
mov eax, dword [esi]
jmp 0x4178d2
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0x14], edi
jb 0x4178e0
mov esi, dword [esi]
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], edi
jae 0x4178eb
lea eax, [ebp - 0x64]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
xor esi, esi
mov eax, dword [ebp - 0x68]
push esi
call fcn.00409830
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.0041e360
push 0x58c578
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.0040b1b0
mov eax, dword [ebp - 0x2c]
add esp, 0x10
cmp dword [ebp - 0x18], edi
jae 0x41792c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x417968
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x417943
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x417955
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x417960
lea eax, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [ebp - 0x18], edi
jb 0x417979
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004310e1
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x34], edi
jb 0x4179a0
mov edx, dword [ebp - 0x48]
push edx
call fcn.004310e1
add esp, 4
inc esi
cmp esi, 8
jl 0x4178f5
cmp dword [ebp - 0x50], edi
jb 0x4179bb
mov eax, dword [ebp - 0x64]
push eax
call fcn.004310e1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret 4
Function at 0x418dd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x418e86
mov eax, dword [ebp + 8]
test eax, eax
je 0x418e24
lea ecx, [ebp + 0xc]
push ecx
push eax
lea edx, [ebp - 0x404]
push 0x3ff
push edx
call fcn.0054f9a3
add esp, 0x10
test eax, eax
js 0x418e1e
cmp eax, 0x3ff
ja 0x418e1e
jne 0x418e2b
mov byte [ebp - 5], 0
jmp 0x418e2b
mov byte [ebp - 0x404], 0
push esi
mov esi, dword [0x5be7b4]
push edi
mov edi, dword [0x5be7b8]
cmp esi, edi
je 0x418e77
lea ecx, [ecx]
cmp dword [esi + 0x14], 0x10
jb 0x418e4a
mov ecx, dword [esi]
jmp 0x418e4c
mov ecx, esi
push 0
lea eax, [ebp - 0x404]
call fcn.00418ea0
add esp, 4
test al, al
jne 0x418e77
add esi, 0x1c
cmp esi, edi
jne 0x418e40
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret

Function at 0x419320
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
inc dword [esi + 0x48]
cmp dword [esi + 0x4c], 0xffffffff
je 0x419337
mov eax, dword [esi + 4]
pop esi
pop ebp
ret 4
test byte [ebp + 8], 2
push ebx
push edi
je 0x41934b
mov edi, 4
mov ebx, 0xf001f
jmp 0x419353
mov edi, 2
lea ebx, [edi + 2]
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push 0
call edx
push eax
mov eax, dword [esi + 0x50]
push 0
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x4c], eax
cmp eax, 0xffffffff
je 0x41938c
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop edi
pop ebx
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x41a280
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d500
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
xor ecx, ecx
add eax, 0xa0
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x48], cl
push eax
mov esi, 0xf
or eax, 0xffffffff
xor ebx, ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
call fcn.00409a30
lea eax, [ebp - 0x48]
push eax
mov eax, str..new
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0040b2f0
add esp, 4
mov ebx, 0x10
mov byte [ebp - 4], 2
cmp dword [ebp - 0x34], ebx
jb 0x41a303
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004310e1
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp dword [ebp - 0x18], ebx
jae 0x41a31c
lea eax, [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x41a333
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x41a345
lea eax, [ebp - 0x2c]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x41a369
cmp ebx, 0xffffffff
jne 0x41a37f
cmp dword [ebp - 0x18], 0x10
jb 0x41a37b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004310e1
add esp, 4
xor al, al
jmp 0x41a3c8
mov esi, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
mov dword [ebp - 0x4c], 0
cmp esi, edi
je 0x41a3a6
lea eax, [ebp - 0x4c]
push eax
push ebx
push esi
call fcn.0041b210
test al, al
je 0x41a3e4
add esi, 0x28
cmp esi, edi
jne 0x41a390
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0x10
jb 0x41a3c6
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004310e1
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x41a3fb
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x18], esi
jb 0x41a37b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004310e1
add esp, 4
xor al, al
jmp 0x41a3c8
Function at 0x41ae60
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x80]
xor edx, edx
div dword [ebp - 8]
mov ecx, dword [esi + 0x4c]
push 0
push 0
push 0
push 2
push 0
push ecx
mov dword [esi + 0x90], edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x7c]
add edx, ecx
push edx
mov edx, dword [esi + 0x80]
sub edx, ecx
push edx
push 0
push 4
push eax
mov dword [esi + 0x88], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x8c], eax
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x41b210
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x10]
push ebx
push esi
movzx esi, al
push edi
add esi, 9
push esi
mov byte [ebp - 1], al
call fcn.004310d6
mov edx, eax
add esp, 4
mov dword [ebp - 8], edx
test edx, edx
je 0x41b252
cmp esi, 1
jb 0x41b252
push 1
lea ecx, [ebp - 1]
push ecx
push esi
push edx
call fcn.005326d1
mov edx, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
lea edi, [edx + 1]
lea ebx, [esi - 1]
jb 0x41b268
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
jmp 0x41b26b
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
movzx eax, byte [ebp - 1]
je 0x41b296
test eax, eax
je 0x41b296
test edi, edi
je 0x41b296
cmp ebx, eax
jb 0x41b296
mov ecx, dword [ebp - 0xc]
push eax
push ecx
push ebx
push edi
call fcn.005326d1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
add esp, 0x10
movzx eax, byte [ebp - 1]
add edi, eax
sub ebx, eax
lea eax, [ecx + 0x20]
test eax, eax
je 0x41b2c1
test edi, edi
je 0x41b2c1
cmp ebx, 4
jb 0x41b2c1
push 4
push eax
push ebx
push edi
call fcn.005326d1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
add esp, 0x10
add edi, 4
sub ebx, 4
add ecx, 0x1c
je 0x41b2e5
test edi, edi
je 0x41b2e5
cmp ebx, 4
jb 0x41b2e5
push 4
push ecx
push ebx
push edi
call fcn.005326d1
mov edx, dword [ebp - 8]
add esp, 0x10
xor ecx, ecx
test esi, esi
je 0x41b30d
jmp 0x41b2f0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
lea ebx, [eax + 1]
and eax, 0xff
mov dword [edi], ebx
mov al, byte [eax + 0x591b08]
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x41b2f0
push 0
lea ecx, [ebp - 0x14]
push ecx
push esi
push edx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b32b
cmp dword [ebp - 0x14], esi
sete bl
jmp 0x41b32d
xor bl, bl
mov eax, dword [ebp - 8]
push eax
call fcn.004310e1
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b350
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
push 0
mov esi, ecx
lea ecx, [ebp - 0x118]
push ecx
mov edi, edx
push 1
lea edx, [ebp - 0x109]
push edx
push esi
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x109], 0
call ebx
test eax, eax
je 0x41b579
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov cl, byte [ebp - 0x109]
and eax, 0xff
xor cl, byte [eax + 0x591b08]
push 0
movzx eax, cl
lea edx, [ebp - 0x118]
push edx
mov byte [ebp - 0x109], cl
push eax
lea ecx, [ebp - 0x108]
push ecx
push esi
call ebx
test eax, eax
je 0x41b579
movzx edx, byte [ebp - 0x109]
cmp edx, dword [ebp - 0x118]
jne 0x41b579
xor ecx, ecx
test edx, edx
jle 0x41b417
mov eax, dword [edi]
lea ebx, [eax + 1]
and eax, 0xff
mov dword [edi], ebx
mov al, byte [eax + 0x591b08]
xor byte [ebp + ecx - 0x108], al
inc ecx
cmp ecx, edx
jl 0x41b3f3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
mov byte [ebp + ecx - 0x108], 0
lea ecx, [ebp - 0x118]
push ecx
push 8
lea edx, [ebp - 0x114]
push edx
push esi
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
call ebx
test eax, eax
je 0x41b579
cmp dword [ebp - 0x118], 8
jne 0x41b579
mov ecx, dword [edi]
lea eax, [ecx + 1]
mov dword [edi], eax
and ecx, 0xff
movzx ecx, byte [ecx + 0x591b08]
xor byte [ebp - 0x114], cl
lea ecx, [eax + 1]
mov dword [edi], ecx
and eax, 0xff
movzx edx, byte [eax + 0x591b08]
xor byte [ebp - 0x113], dl
lea eax, [ecx + 1]
mov dword [edi], eax
and ecx, 0xff
movzx ecx, byte [ecx + 0x591b08]
xor byte [ebp - 0x112], cl
lea ecx, [eax + 1]
mov dword [edi], ecx
and eax, 0xff
movzx edx, byte [eax + 0x591b08]
xor byte [ebp - 0x111], dl
lea eax, [ecx + 1]
mov dword [edi], eax
and ecx, 0xff
movzx ecx, byte [ecx + 0x591b08]
xor byte [ebp - 0x110], cl
lea ecx, [eax + 1]
mov dword [edi], ecx
and eax, 0xff
movzx edx, byte [eax + 0x591b08]
xor byte [ebp - 0x10f], dl
lea eax, [ecx + 1]
mov dword [edi], eax
and ecx, 0xff
movzx ecx, byte [ecx + 0x591b08]
xor byte [ebp - 0x10e], cl
lea edx, [eax + 1]
and eax, 0xff
mov dword [edi], edx
mov al, byte [eax + 0x591b08]
xor byte [ebp - 0x10d], al
lea eax, [ebp - 0x108]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b520
mov esi, dword [ebp - 0x11c]
sub eax, ecx
mov edi, eax
lea eax, [ebp - 0x108]
call fcn.00409b10
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x114]
mov dword [esi + 0x1c], edx
push eax
lea edx, [ebp - 0x108]
mov dword [esi + 0x20], ecx
call fcn.0041e320
add esp, 4
pop edi
mov word [esi + 0x24], ax
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.005320a3
mov esp, ebp
pop ebp
ret 8