joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411660
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44fbb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x5c
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.004352aa
inc eax
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
call fcn.0042dc09
mov edi, dword [esp + 0xc]
mov byte [esp + 0x24], 1
mov esi, 0x46b118
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4116d6
test cl, cl
je 0x4116d2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4116d6
add eax, 2
add esi, 2
test cl, cl
jne 0x4116ae
xor eax, eax
jmp 0x4116db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41186d
mov esi, 0x463f94
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x411712
test cl, cl
je 0x41170e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x411712
add eax, 2
add esi, 2
test cl, cl
jne 0x4116ea
xor eax, eax
jmp 0x411717
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41186d
push 0x46314c
lea ecx, [esp + 0x14]
call fcn.00434e51
mov eax, dword [esp + 0x2c]
mov cl, byte [eax]
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
push edx
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.00435329
mov eax, dword [esp + 0xc]
mov esi, 0x46b118
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41177d
test cl, cl
je 0x411779
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41177d
add eax, 2
add esi, 2
test cl, cl
jne 0x411755
xor eax, eax
jmp 0x411782
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41185f
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004352aa
inc eax
push eax
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042dc2c
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 3
call fcn.004351fb
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.00434de3
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004352aa
inc eax
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call fcn.0042dc09
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 4
call fcn.00434f1c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 2
call fcn.00434de3
mov edx, dword [esp + 0x14]
push 0
push edx
call edi
test eax, eax
jne 0x411824
call ebp
cmp eax, 0xb7
je 0x411824
call fcn.004028e0
mov eax, dword [esp + 0x10]
mov esi, 0x46b118
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x411851
test cl, cl
je 0x41184d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x411851
add eax, 2
add esi, 2
test cl, cl
jne 0x41182d
xor eax, eax
jmp 0x411856
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x411797
pop ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.00434de3
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.00434de3
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.00434de3
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x42d090
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041c5f0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42d15b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42d15b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42d10e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x42d119
or bh, 8
and edi, 0x8000000
je 0x42d134
mov eax, dword [0x46fabc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42d15b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42d55b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42d57f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42d59a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4307f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x430812
cmp dword [edi + 0x3c], 0
jne 0x430812
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00446e5a
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0043083f
pop edi
pop esi
pop ebx
ret 8

Function at 0x43088d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00446e5a
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4308be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004308d1
pop edi
pop esi
pop ebx
ret 8

Function at 0x431e7f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x431eb7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0043528a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00435262
jmp 0x431ec3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x433a85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x433ac7
call fcn.00446e5a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x433ac7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x433abe
xor eax, eax
jmp 0x433acf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00433ad5
pop edi
pop esi
pop ebx
ret 4
Function at 0x4472d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00446e5a
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x44730e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44730e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x447312
xor eax, eax
jmp 0x447390
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004353c7
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x44734a
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x447334
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.00447481
push ebx
mov edi, eax
call fcn.004353f0
test edi, edi
pop ecx
je 0x44738c
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0044724a
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00447395
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4491af
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4491dd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4491fb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00449115
jmp 0x4491fb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4491fb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00449115
test edi, edi
mov eax, edi
jne 0x4491e5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4027a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x425448
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x42e110]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
sub esp, 0xc
lea ecx, [esp + 0x30]
mov esi, esp
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], esp
call fcn.0041b390
push edi
call fcn.00402700
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
mov esi, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
lea ecx, [esp + 0x24]
setb bl
call fcn.0041b440
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0xc

Function at 0x403bd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x425068
mov eax, dword fs:[0]
push eax
push ebp
push esi
mov eax, dword [0x42e110]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], ecx
lea esi, [edi + 0xc]
mov ecx, ebp
mov dword [edi], eax
mov dword [edi + 8], edx
mov dword [esp + 0x20], esi
call fcn.0041b390
add esi, 0xc
lea ecx, [ebp + 0xc]
push esi
mov dword [esp + 0x18], 0
call fcn.00401490
mov al, byte [esp + 0x24]
mov byte [edi + 0x30], al
mov byte [edi + 0x31], 0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x406a00
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x424d78
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42e110]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x406a44
mov eax, dword [esp + 0x2c]
push ecx
push ecx
push ecx
push eax
lea eax, [ecx + 2]
call fcn.004080c0
xor al, al
jmp 0x406bd0
mov ebx, dword [esp + 0x2c]
mov edi, ebx
call fcn.00406220
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.0040aa1b
push esi
call fcn.0040a923
push 0
push 0
push esi
mov edi, eax
call fcn.0040aa1b
add esp, 0x1c
test edi, edi
jg 0x406a93
push 0
push 0
push 0
push ebx
mov eax, 0xd
call fcn.004080c0
xor al, al
jmp 0x406bd0
mov dword [esp + 0x18], 0x4305a8
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x28], 0
call fcn.00405970
lea edx, [edi + 1]
push edx
call fcn.0040a18d
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.0040a769
add esp, 0x14
cmp eax, 1
je 0x406b03
push ebp
call fcn.00409dad
add esp, 4
push 0
push 0
push 0
push ebx
mov eax, 2
call fcn.004080c0
mov eax, dword [esp + 0x18]
cmp eax, 0x4305a8
je 0x406afc
push eax
call fcn.00409da2
add esp, 4
xor al, al
jmp 0x406bd0
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x406b6d
mov cl, byte [esi]
cmp cl, 0xa
jne 0x406b2d
mov ecx, esi
sub ecx, eax
inc ecx
push ecx
push eax
lea ebx, [esp + 0x20]
call fcn.00405b10
inc esi
mov eax, esi
jmp 0x406b68
cmp cl, 0xd
jne 0x406b67
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x406b45
push ecx
push eax
lea ebx, [esp + 0x20]
call fcn.00405b10
push 1
lea edx, [esp + 0x18]
push edx
lea ebx, [esp + 0x20]
mov byte [esp + 0x1c], 0xa
call fcn.00405b10
cmp byte [esi + 1], 0xa
jne 0x406b28
add esi, 2
mov eax, esi
jmp 0x406b68
inc esi
cmp byte [esi], 0
jne 0x406b11
sub esi, eax
je 0x406b7c
push esi
push eax
lea ebx, [esp + 0x20]
call fcn.00405b10
push ebp
call fcn.00409dad
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
mov edx, dword [eax + 8]
add esp, 4
push 0
push 0
lea ecx, [esi + 8]
push ecx
mov ecx, edi
call edx
cmp byte [edi + 0x2c], 0
je 0x406bbd
cmp esi, 0x4305a8
je 0x406afc
push esi
call fcn.00409da2
add esp, 4
xor al, al
jmp 0x406bd0
cmp esi, 0x4305a8
je 0x406bce
push esi
call fcn.00409da2
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x4091b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
push edi
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4091f9
cmp dword [esp + 0x18], 2
jne 0x4091f9
cmp dword [esp + 0xc], 6
jne 0x4091f9
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4092b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, ebx
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4092c0
mov eax, dword [str.eSellerate_]
mov dword [edi], eax
mov ecx, dword [0x4262f8]
mov dword [edi + 4], ecx
mov edx, dword [0x4262fc]
mov dword [edi + 8], edx
mov al, byte [0x426300]
push ebx
mov byte [edi + 0xc], al
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4092fe
and eax, 0x10
mov dword [esp + 8], eax
jne 0x40930f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40930f
pop edi
pop ebx
pop ecx
ret
mov eax, dword [section..data]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409316
sub eax, edx
dec ebx
mov edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409322
push esi
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x409350
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop esi
ret
Function at 0x409380
Capabilities:
Delete file
Get common file path
Move file
Query environment variable
Set file attributes

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
cmp byte [esi], 0
jne 0x40939d
xor eax, eax
pop esi
add esp, 0x104
ret
push ebx
push ebp
push edi
call fcn.004091b0
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
je 0x409410
push 0x104
lea eax, [esp + 0x14]
push eax
push str.allusersprofile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4093db
lea ecx, [esp + 0x10]
push ecx
call fcn.004092b0
add esp, 4
push 0x80
lea edx, [esp + 0x14]
push edx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
je 0x409416
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x104
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esp + 0x11c]
cmp byte [esi], 0
je 0x40943c
push 0x80
push esi
call ebx
push esi
call edi
mov edx, dword [esp + 0x118]
push esi
push edx
call ebp
test eax, eax
jne 0x409400
lea eax, [esp + 0x10]
push eax
call fcn.00409cc0
lea ecx, [esp + 0x14]
push ecx
call fcn.004092b0
add esp, 8
push 0x80
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
call edi
mov edx, dword [esp + 0x118]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
test eax, eax
jne 0x409400
push 0x104
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x10]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409490
mov cx, word [0x4262cc]
mov eax, dword [section..data]
mov word [edi], cx
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4094b0
lea edi, [esp + 0x10]
sub eax, esi
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4094c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
lea edx, [esp + 0x14]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call ebx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [esp + 0x118]
lea ecx, [esp + 0x10]
push ecx
push ebx
call ebp
test eax, eax
jne 0x409400
mov al, byte [0x426316]
mov dx, word [0x426314]
mov byte [esp + 0x12], al
mov eax, dword [section..data]
mov word [esp + 0x10], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409520
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409530
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.00409350
add esp, 8
test eax, eax
jne 0x409400
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x104
ret
Function at 0x409580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
mov ax, word [0x426314]
mov cl, byte [0x426316]
mov word [esp], ax
push esi
push edi
mov byte [esp + 0xa], cl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xb]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [section..data]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4095b7
lea edi, [esp + 8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4095c5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 8]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edx
call esi
test eax, eax
jne 0x40965e
call fcn.004091b0
test eax, eax
je 0x409634
push 0x104
lea eax, [esp + 0xc]
push eax
push str.allusersprofile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x409621
lea ecx, [esp + 8]
push ecx
call fcn.004092b0
add esp, 4
test eax, eax
jne 0x409629
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 8]
push edx
call esi
test eax, eax
jne 0x40965e
lea eax, [esp + 8]
push eax
call fcn.00409cc0
lea ecx, [esp + 0xc]
push ecx
call fcn.004092b0
add esp, 8
lea edx, [esp + 8]
push edx
call esi
test eax, eax
jne 0x40965e
mov eax, dword [section..data]
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409760
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409806
test ebx, ebx
je 0x409806
mov ecx, dword [esp + 0x3c]
xor eax, eax
test ecx, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x4097d5
push esi
mov esi, dword [esp + 0x3c]
push edi
mov ecx, 9
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
xor byte [esp + eax + 0xc], 0x36
inc eax
cmp eax, 0x24
jl 0x4097b0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x24
lea edx, [esp + 0x18]
push edx
push ebx
call ebp
test eax, eax
je 0x4097f1
mov eax, 0x24
mov edx, dword [esp + 0x3c]
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x40]
sub edx, eax
push edx
add eax, ecx
push eax
push ebx
call ebp
test eax, eax
jne 0x4097f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
add esp, 0x28
ret