joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x402aa4
jl 0x402a98
test esi, esi
jne 0x402aa4
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402abd
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov ecx, dword [eax]
test ecx, ecx
je 0x402afb
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x402afb
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push ecx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp + 8], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
jmp 0x402b01
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x402b80
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x402b2a
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp + 8]
cmp edi, 0xfff
jbe 0x402b6c
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp + 8]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp + 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x402b93
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x402b40
test edx, edx
je 0x402b80
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402f20
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x402f50
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x402f50
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x403026
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402f79
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402f85
movsx eax, bl
jmp 0x402fbd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x402fe7
sub eax, 1
je 0x402fe7
sub eax, 2
jne 0x403026
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403005
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403026
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x403026
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
Function at 0x403290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40334c
cmp byte [esi + 0x3d], 0
je 0x40334c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40333a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403301
sub eax, 1
je 0x403305
sub eax, 2
jne 0x40333a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403323
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40333a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00423570
mov esp, ebp
pop ebp
ret

Function at 0x403da0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x403dbb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x403dc6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x403dd1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x403ddc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x403de7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x403df2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x403dfd
bts eax, 1
test cl, 2
je 0x403e06
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x403ea2
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x403e93
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x403db0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403ed0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x42799c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x403f0a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x403f38
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x403f8c
push esi
nop
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x403f52
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x403f50
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4041e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0c
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x408]
call fcn.004016c0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0xc08]
push 0x427e48
push eax
call fcn.00401700
lea eax, [ebp - 0xc08]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404238
push 0
lea ecx, [ebp - 0xc0c]
sub eax, edx
push ecx
push eax
lea eax, [ebp - 0xc08]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00423570
mov esp, ebp
pop ebp
ret
Function at 0x404270
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x50ed70
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x40429b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x4042a6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x4042b1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x4042bc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x4042c7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x4042d2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x4042dd
bts eax, 1
test cl, 2
je 0x4042e6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x40437f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x404370
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x50ed70], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x404290
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4043b0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x4279a0
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x404402
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x404452
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x50ed70]
sub edx, 1
jne 0x404430
cmp edi, 0x400
je 0x404404
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
Function at 0x4049e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404a67
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x43320c]
mov dword [0x433210], eax
test ecx, ecx
je 0x404a33
push ecx
call fcn.00423bbb
mov eax, dword [0x433210]
add esp, 4
mov dword [0x43320c], 0
push eax
call fcn.00423bc0
add esp, 4
mov dword [0x43320c], eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push 0
push ecx
push dword [0x433210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x404a6e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x404a80
Capabilities:
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push ebx
push 0x427ec4
push eax
mov dword [ebp - 0x354], ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x358], eax
cmp eax, 0xffffffff
je 0x404c2e
nop word [eax + eax]
test byte [ebp - 0x34c], 0x10
lea eax, [ebp - 0x320]
jne 0x404c41
push eax
push ebx
lea eax, [ebp - 0x10c]
push 0x427ec8
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
call fcn.004049e0
test al, al
je 0x404c13
cmp dword [0x433210], 8
jb 0x404b42
mov ecx, dword [0x43320c]
mov eax, dword [ecx]
cmp eax, dword [0x427c24]
jne 0x404b42
mov eax, dword [ecx + 4]
cmp eax, dword [0x427c28]
je 0x404c13
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c0d
mov ecx, dword [0x433210]
add ecx, 8
push ecx
call fcn.00423bc0
mov ecx, dword [0x427c24]
mov ebx, eax
mov edx, dword [0x427c28]
add esp, 4
mov dword [ebx], ecx
lea edi, [ebx + 8]
mov dword [ebx + 4], edx
push dword [0x433210]
push dword [0x43320c]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x433210]
add esp, 0xc
xor edx, edx
test eax, eax
jle 0x404be1
mov eax, edx
and eax, 0xf
mov al, byte [eax + 0x427c14]
xor byte [edi + edx], al
mov eax, edx
and eax, 0x1f
movsx eax, byte [eax + 0x50f1fc]
and eax, 0xf
mov al, byte [eax + 0x427c14]
add byte [edi + edx], al
inc edx
mov eax, dword [0x433210]
cmp edx, eax
jl 0x404bb1
push 0
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x350], 0
push ecx
add eax, 8
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x354]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404ae0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x427edc
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404c66
test dl, dl
je 0x404c62
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404c66
add eax, 2
add ecx, 2
test dl, dl
jne 0x404c46
xor eax, eax
jmp 0x404c6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404c13
mov eax, 0x427ed0
lea ecx, [ebp - 0x320]
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404ca0
test dl, dl
je 0x404c9c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404ca0
add ecx, 2
add eax, 2
test dl, dl
jne 0x404c80
xor eax, eax
jmp 0x404ca5
sbb eax, eax
or eax, 1
test eax, eax
je 0x404c13
lea eax, [ebp - 0x320]
push eax
push ebx
lea eax, [ebp - 0x10c]
push 0x427ed4
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
mov ecx, 0x433208
push eax
call fcn.00404a80
jmp 0x404c13
Function at 0x406140
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x764
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x508]
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
push 0x428270
push eax
mov dword [ebp - 0x75c], esi
call ebx
add esp, 0xc
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
je 0x406310
nop dword [eax + eax]
test byte [ebp - 0x758], 0x10
lea eax, [ebp - 0x72c]
jne 0x406257
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s
push eax
call ebx
mov eax, esi
add esp, 0x10
sub eax, 0
je 0x406247
sub eax, 1
je 0x4061ee
sub eax, 1
jne 0x4062f5
lea eax, [ebp - 0x208]
push eax
call fcn.004043b0
mov edx, str..DataProtectEncrypt_Protect_
jmp 0x4061ff
lea eax, [ebp - 0x208]
push eax
call fcn.004043b0
mov edx, str..DataProtectChecksum_
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.00406630
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push str.__S__t_t_t_0x_X__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [0x50ed68]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov esi, dword [ebp - 0x75c]
add esp, 0x18
jmp 0x4062f5
lea ecx, [ebp - 0x208]
call fcn.004064b0
jmp 0x4062f5
mov ecx, 0x428284
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406286
test dx, dx
je 0x406282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406286
add eax, 4
add ecx, 4
test dx, dx
jne 0x406260
xor eax, eax
jmp 0x40628b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4062f5
mov eax, 0x428288
lea ecx, [ebp - 0x72c]
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4062c6
test dx, dx
je 0x4062c2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4062c6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4062a0
xor eax, eax
jmp 0x4062cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4062f5
lea eax, [ebp - 0x72c]
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s_
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0x208]
mov edx, esi
call fcn.00406140
lea eax, [ebp - 0x758]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4061a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret
Function at 0x406330
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push 3
push 0
push 1
push closesocket
push ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x406499
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x406492
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x406492
push ebx
push esi
push dword [ebp - 0x14]
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x406471
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x40646a
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x40646a
movzx eax, word [esi + 4]
mov ecx, 0x14c
cmp ax, cx
je 0x4063ef
mov ecx, 0x8664
cmp ax, cx
jne 0x40646a
push dword [esi + 0x28]
push dword [esi + 0x34]
push esi
call dword [sym.imp.dbghelp.dll_ImageRvaToSection]
test eax, eax
je 0x40646a
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0xc]
add ecx, dword [esi + 0x28]
push 0
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40646a
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
push 0x20
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40646a
mov eax, dword [esi + 0x28]
mov ecx, dword [ebp - 0x48]
add eax, dword [esi + 0x34]
push ebx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.00423570
mov esp, ebp
pop ebp
ret
Function at 0x40ddf0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4339d0]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
js 0x40defa
cmp eax, 3
jge 0x40defa
imul edi, eax, 0x214
inc eax
push ecx
mov dword [0x4339d0], eax
mov eax, dword [ebp + 8]
push 0x100
add edi, 0x433394
lea ebx, [edi + 4]
mov dword [edi], eax
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
cmp dword [edi], 0
je 0x40defa
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x14]
lea esi, [edi + 0x110]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0xe]
push eax
push ecx
push edx
push ebx
push str.._sSGG__02d__02d__04d.txt
push esi
mov dword [edi + 0x104], edx
mov dword [edi + 0x108], ecx
mov dword [edi + 0x10c], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x210], eax
cmp eax, 0xffffffff
jne 0x40ded6
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40defa
push dword [edi + 0x210]
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret 8