joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c460
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54c470
sub eax, edx
mov esi, eax
lea ebp, [esi + esi]
push ebp
call dword [0x5b4cd4]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x54c499
pop edi
pop esi
pop ebp
lea eax, [ebx + 0x1b]
pop ebx
add esp, 0xc
ret
mov ecx, ebx
call fcn.0054c430
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x54c51f
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x54c512
mov eax, dword [esp + 0x10]
push 0
push ebp
push ebx
push eax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [esi + 0x10], eax
push ebx
mov byte [esi + 0x14], al
call dword [0x5b4cd8]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x54ec80
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x54eca2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x54ec96
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x54ecd2
cmp dword [esi + 8], 0
jne 0x54ecc5
mov ecx, dword [eax + 8]
push 0x562434
push ecx
call fcn.0050040b
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x54ecc5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00500981
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x54ecf4
mov eax, dword [esi + 8]
test eax, eax
je 0x54ecee
push eax
call fcn.0050028f
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x551ef0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5b4cd4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x551f15
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x551f5c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x551f60
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x551fbe
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x551f83
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x552001
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x5951e5
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x5951e6
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x551fd0
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x552139
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x552160
call fcn.005030b7
mov dword [eax], esi
call fcn.005030a4
push 0x16
pop esi
mov dword [eax], esi
call fcn.005074b6
mov eax, esi
jmp 0x5521b5
test dword [ebp + 0xc], 0xfffffff9
jne 0x552146
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x55218d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005030ca
pop ecx
call fcn.005030a4
mov eax, dword [eax]
jmp 0x5521b5
test al, 0x10
jne 0x5521b3
test al, 1
je 0x5521b3
test byte [ebp + 0xc], 2
je 0x5521b3
call fcn.005030b7
mov dword [eax], 5
call fcn.005030a4
mov dword [eax], 0xd
jmp 0x552184
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401473
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x401510
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x401510
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x401510
push 4
push 0xffffffffffffffff
push esi
push 0x401c03
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x401510
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x4014db
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x401510
push dword [esi + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x401516
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x401512

Function at 0x401622
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x34
push ebx
mov dword [ebp - 8], ebx
lea esi, [edi + 0xa0]
push esi
call fcn.0040b260
add esp, 0xc
lea eax, [edi + 0x8c]
push eax
lea eax, [ebp - 8]
push eax
push 0x34
push esi
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne cl
mov byte [ebp - 1], cl
test eax, eax
jne 0x401671
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [ebp - 1]
mov ebx, eax
test cl, cl
jne 0x401688
cmp ebx, 0x3e5
je 0x401688
push 0xa
mov ecx, edi
call fcn.004018d1
jmp 0x401692
mov dword [edi + 0x84], 5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401978
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x38], 2
push edi
mov ebx, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.004018fc
test al, al
jne 0x401a10
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp - 0x10], esi
je 0x4019e5
push 1
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
push dword [edi + 0x2c]
call ebx
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0xc], esi
je 0x4019fb
push 1
push esi
push esi
push esi
push esi
push dword [ebp - 0xc]
push dword [edi + 0x2c]
call ebx
mov dword [ebp - 0xc], esi
cmp dword [ebp - 8], esi
je 0x401a50
push 1
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [edi + 0x2c]
call ebx
jmp 0x401a50
lea eax, [ebx + 0x8c]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
push 0x34
lea eax, [ebp - 0x38]
push eax
push dword [ebx + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne cl
mov byte [ebp + 0xb], cl
test eax, eax
jne 0x401a44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [ebp + 0xb]
mov esi, eax
test cl, cl
jne 0x401a54
cmp esi, 0x3e5
je 0x401a54
xor al, al
jmp 0x401a5c
push edi
mov ecx, ebx
call fcn.00401b7b
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4031a3
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x678
mov eax, dword [0x43e0a4]
xor eax, esp
mov dword [esp + 0x674], eax
push ebx
push ebp
push esi
push edi
mov ebp, dword [esp + 0x68c]
lea edi, [esp + 0x78]
and dword [esp + 0x10], 0
lea eax, [esp + 0x88]
mov esi, str.unknown
mov ebx, ecx
push 0x1f8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
push eax
call fcn.0040b260
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push dword [ebx + 0x10]
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40322c
mov esi, 0x104
lea eax, [esp + 0x78]
push esi
push eax
push dword [esp + 0x1c]
push dword [ebx + 0x10]
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [esp + 0x78]
push esi
push eax
call fcn.00411928
pop ecx
pop ecx
push edi
call fcn.00410ff6
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], edx
push eax
call fcn.00411611
lea edx, [ebx + 0x2002c]
add esp, 0xc
test edx, edx
je 0x40326c
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40325b
sub ecx, esi
sar ecx, 1
jne 0x403270
lea edx, [esp + 0x78]
inc dword [0x440da8]
mov ecx, str.assert
push dword [0x440da8]
mov eax, dword [esp + 0x38]
push dword [esp + 0x28]
inc eax
push dword [esp + 0x30]
push dword [esp + 0x38]
push dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x50]
add eax, 0x76c
cmp dword [ebx + 0x20], edi
push eax
push edx
mov eax, str.crash
cmove eax, ecx
push eax
push str._s__s__d_.2d_.2d_.2d_.2d_.2d__d.dmp
lea eax, [esp + 0x2a8]
push 0x200
push eax
call fcn.004027ec
add esp, 0x2c
lea edx, [ebx + 0x20130]
lea ecx, [esp + 0x64]
call fcn.0040369c
pop ecx
lea ecx, [esp + 0x280]
mov esi, eax
call fcn.00401145
push eax
lea eax, [esp + 0x284]
mov ecx, esi
push eax
call fcn.00403480
push eax
lea ecx, [esp + 0x4c]
call fcn.00402001
lea eax, [esp + 0x48]
mov ecx, ebp
push eax
call fcn.004033c9
push edi
push 1
lea ecx, [esp + 0x50]
call fcn.004020fa
push edi
push 1
lea ecx, [esp + 0x68]
call fcn.004020fa
mov ecx, dword [esp + 0x684]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409ca0
add esp, 0x678
ret 4
Function at 0x404562
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
sub esp, 0x9c
mov eax, dword [0x43e0a4]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
xor eax, eax
mov dword [esp + 0x28], edx
push edi
push eax
mov byte [esp + 0x1b], al
mov ebx, eax
mov dword [esp + 0x44], eax
mov ebp, ecx
mov byte [esp + 0x34], al
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x68]
mov dword [esp + 0x28], 0x40
push eax
push 5
push ebp
mov dword [esp + 0x58], 0xf
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4045d9
push 0xa
lea eax, [esp + 0x64]
mov byte [esp + 0x1b], 1
push ebx
push eax
call fcn.00417513
add esp, 0xc
lea ecx, [esp + 0x30]
mov ebx, eax
push ebx
call fcn.00404dd0
xor eax, eax
push eax
mov dword [esp + 0x20], eax
push eax
jmp 0x40464d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4046a8
xor edx, edx
push ecx
inc edx
mov ecx, edi
call fcn.0040117f
pop ecx
push edi
mov esi, eax
push 0
push esi
call fcn.0040b260
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [esp + 0x28], eax
test eax, eax
je 0x404690
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x404690
add dword [esp + 0x1c], ecx
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00404e04
test esi, esi
je 0x404649
push 1
mov edx, edi
mov ecx, esi
call fcn.004011d7
pop ecx
push 0
push 0
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x4045e3
xor bl, bl
mov edx, dword [esp + 0x44]
cmp edx, 0x10
jb 0x404675
mov ecx, dword [esp + 0x30]
inc edx
push 1
call fcn.004011d7
pop ecx
mov ecx, dword [esp + 0xa4]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409ca0
add esp, 0x9c
ret
test esi, esi
je 0x4046a4
push 1
mov edx, edi
mov ecx, esi
call fcn.004011d7
mov eax, dword [esp + 0x2c]
pop ecx
test eax, eax
je 0x40465d
cmp byte [esp + 0x17], 0
je 0x4046b5
cmp dword [esp + 0x1c], ebx
jne 0x40465d
mov esi, dword [esp + 0x2c]
mov bl, 1
test esi, esi
je 0x40465f
lea edx, [esp + 0x30]
lea ecx, [esp + 0x48]
call fcn.00404c02
push eax
mov ecx, esi
call fcn.004033c9
push 0
push 1
lea ecx, [esp + 0x50]
call fcn.004020fa
jmp 0x40465f
Function at 0x4060f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x43e0a4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x406251
cmp byte [edi + 0x3d], bl
je 0x406251
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x406136
xor al, al
jmp 0x406253
push ebx
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00405f74
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae ecx, dword [esp + 0x14]
cmovae esi, dword [esp + 0x14]
add eax, ecx
mov ecx, dword [edi + 0x38]
mov edx, dword [ecx]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x38]
push eax
push esi
lea eax, [edi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x4061b3
sub eax, 1
je 0x4061b6
dec eax
sub eax, 1
jne 0x406196
mov bl, 1
mov edx, dword [esp + 0x28]
cmp edx, 0x10
jb 0x4061ac
mov ecx, dword [esp + 0x14]
inc edx
push 1
call fcn.004011d7
pop ecx
mov al, bl
jmp 0x406253
mov byte [edi + 0x3d], bl
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp edx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, ecx
sub esi, eax
je 0x4061ed
push dword [edi + 0x4c]
cmp edx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.0041ddbe
add esp, 0x10
cmp esi, eax
jne 0x406196
cmp byte [edi + 0x3d], bl
je 0x406194
test esi, esi
jne 0x406152
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x406265
lea esi, [ecx + 8]
push ebx
push esi
lea ecx, [esp + 0x1c]
call fcn.00405eb8
test al, al
je 0x406152
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x24]
cmovae ecx, dword [esp + 0x14]
mov dword [ecx + eax], ebx
mov dword [ecx + eax + 4], ebx
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x24], esi
cmovae eax, dword [esp + 0x14]
mov byte [eax + esi], bl
jmp 0x406152
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409ca0
mov esp, ebp
pop ebp
ret
call fcn.0040233a
int3
Function at 0x408a10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push str._pid
push dword [ebp + 0x10]
xor esi, esi
call fcn.0040b3c0
add esp, 8
test eax, eax
je 0x408a39
add eax, 5
push eax
call fcn.00410e88
add esp, 4
mov esi, eax
push 0x4c
call fcn.00406a20
add esp, 4
test eax, eax
je 0x408a53
push esi
mov ecx, eax
call fcn.004072a0
mov ebx, eax
jmp 0x408a55
xor ebx, ebx
test esi, esi
jne 0x408a60
mov eax, str.SteamErrorReporter_Running
jmp 0x408a7f
push esi
push str.SteamErrorReporter_Running
push str._s__d
push 0x40
push 0x43ece8
call fcn.00408b50
add esp, 0x14
mov eax, 0x43ece8
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.SteamErrorReporter_process_started_n
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00407f30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SteamErrorReporter_process_shutting_down_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00407b00
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x408ad5
mov ecx, esi
call fcn.00401386
push 0xd8
push esi
call fcn.00406a50
add esp, 8
mov esi, dword [ebx + 0x10]
mov dword [ebx + 0xc], 0
test esi, esi
je 0x408b36
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x408b18
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x408b0e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b45
mov eax, edx
push ecx
push eax
call fcn.00406a50
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
push 0x24
push esi
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00406a50
add esp, 8
pop esi
mov dword [ebx + 0x10], 0
xor eax, eax
pop ebx
pop ebp
ret 0x10
call fcn.0040d12e
int3

Function at 0x408d00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x42f5dc
mov dword [ebp - 4], 0
call fcn.00409200
push 0
lea ecx, [ebp - 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408d48
xor bl, bl
jmp 0x408d4a
mov bl, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x408d5a
push eax
call fcn.00406a50
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x408d6a
push eax
call fcn.00406a50
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x42f5dc
mov dword [ebp - 4], 0
call fcn.00409200
lea ecx, [ebp - 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x408e17
push eax
call fcn.00406a50
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x408e27
push ecx
call fcn.00406a50
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x42f5dc
mov dword [ebp - 4], 0
call fcn.00409200
lea ecx, [ebp - 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408e6e
test al, 0x10
je 0x408e6e
mov bl, 1
jmp 0x408e70
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x408e80
push eax
call fcn.00406a50
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x408e90
push eax
call fcn.00406a50
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409410
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x42f5dc
mov dword [ebp - 4], 0
call fcn.00409200
lea ecx, [ebp - 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409461
test al, 3
je 0x40945d
and eax, 0xfffffffc
lea ecx, [ebp - 0xc]
push eax
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x409463
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x409473
push eax
call fcn.00406a50
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x409483
push eax
call fcn.00406a50
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409490
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x42f5dc
mov dword [ebp - 4], 0
call fcn.00409200
lea ecx, [ebp - 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x4094d6
push eax
call fcn.00406a50
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4094e6
push ecx
call fcn.00406a50
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f0c8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041ef3e
Function at 0x10f0e8fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10f0e906
pushal
call 0x10f0e90c
pop ebp
sub ebp, 0x10
sub ebp, 0xf0e8fc
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10f0e930
and al, 0x28
add byte [eax], al
add byte [eax - 0x7bf0fe08], al
pop es
add byte [eax], al
add byte [ecx + 0x33], ah
rol byte [eax - 0x3e], 0xc
add cl, ch
add al, 0
add byte [eax], al
mov bh, byte [ebp - 0x347805a]
call 0xd5f3ea30
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10f0e939
mov eax, 0xf0e8fc
add eax, ebp
add eax, 0x63
mov ecx, 0x59d
mov edx, 0x70c5be98
xor byte [eax], dl
inc eax
dec ecx
jne 0x10f0e950
jmp 0x10f0e963
adc edx, dword [ebp + 0x13]
adc dword [eax + ebx*4 + 0x59199898], esp
pushal
cwde
cwde
cwde
wait
push ebp
and byte [esi + 0x22989898], bl
mov al, 0x98
cwde
cwde
outsd dx, dword [esi]
jp 0x10f0e91b
push eax
adc ebx, dword [ecx]
xchg esp, eax
cwde
cwde
cwde
wait
pop ebp
enter 0xfffffffffffff0c8, 0xffffffffffffff90
pop eax
mov ah, 0x98
invalid
Function at 0xd6b87a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jmp 0xc3dcb3
je 0xc232cd
mov esi, dword [ebp + 0xc]
cmp cx, dx
test esi, esi
jmp 0xc65abe
push ebp
mov ebp, esp
or ecx, edi
mov ecx, dword [ebp + 8]
cmp dh, 1
test ebp, edi
stc
sub esp, 0x114
clc
push esi
clc
stc
jmp 0xc0eaa8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx