joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48459c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push 0x1f
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x1f
call fcn.004048b4
add esp, 0x20
pop ebx
ret

Function at 0x484680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b10
mov eax, dword [ebp - 8]
call fcn.00404b10
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x484747
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.004030e8
mov dword [esi], 0x3c
mov dword [esi + 4], 0x140
call sub.user32.dll_GetActiveWindow
mov dword [esi + 8], eax
mov eax, 0x484754
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00404b20
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00404b20
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], ebx
push esi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x48472c
mov ebx, dword [esi + 0x38]
jmp 0x484717
mov eax, dword [0x489da0]
mov eax, dword [eax]
call fcn.0045b204
push 1
call sub.kernel32.dll_Sleep_1
push 0x32
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x484704
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48474e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404668
ret

Function at 0x484ae0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00404644
xor edx, edx
push ebp
push 0x484b60
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov al, 1
call fcn.00407778
lea edx, [ebp - 0x190]
push edx
push eax
call sub.wsock32.dll_WSAStartup
push 0x80
lea eax, [ebp - 0x211]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x211]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x484b51
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.0040483c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484b6a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014c4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, str.Server
push 0
push str.UseNTAccount
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
setne al
push 0x12c
mov byte [edi], al
lea eax, [edi + 2]
push eax
push 0x420688
push str.DataSource
push esi
call ebx
push dword [ebp + 8]
lea eax, [edi + 0x25a]
push 0x12c
push eax
push 0x420688
push str.Database
push esi
call ebx
cmp byte [edi], 0
push dword [ebp + 8]
lea eax, [edi + 0x4b2]
push 0x12c
push eax
push 0x420688
je 0x401561
push str.NTUserName
push esi
call ebx
push dword [ebp + 8]
add edi, 0x70a
push 0x12c
push edi
push 0x420688
push str.NTPassword
jmp 0x401582
push str.UserName
push esi
call ebx
push dword [ebp + 8]
add edi, 0x70a
push 0x12c
push edi
push 0x420688
push str.Password
push esi
call ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40158c
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x429e98]
mov edx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x214], eax
mov esi, ecx
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x103
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x218], edx
call sub.msvcrt.dll_wcsncpy
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 0x14
add esi, 8
cmp eax, ebx
push esi
push ebx
push 2
push dword [ebp - 0x214]
jne 0x401615
push 0x4206f0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
jmp 0x401648
mov edi, dword [sym.imp.ADVAPI32.dll_LogonUserW]
lea ecx, [ebp - 0x20c]
mov word [eax], bx
push ecx
add eax, 2
push eax
call edi
cmp eax, ebx
mov dword [ebp - 0x210], eax
jne 0x401652
push esi
push ebx
push 2
push dword [ebp - 0x214]
push ebx
push dword [ebp - 0x218]
call edi
cmp eax, ebx
mov dword [ebp - 0x210], eax
je 0x40166d
mov esi, dword [esi]
cmp esi, ebx
je 0x401665
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], ebx
jne 0x401680
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Impersonation_failed____d_n
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x210], ebx
pop edi
pop esi
setne al
pop ebx
call fcn.0041e7f6
leave
ret 8
Function at 0x401db6
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x41e923
call fcn.0041e140
sub esp, 0x654
mov eax, dword [0x429e98]
push ebx
push esi
mov dword [ebp - 0x10], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov esi, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcslen
mov ecx, 0x103
sub ecx, eax
push ecx
lea eax, [ebp - 0x218]
push str._regsvr32.exe
push eax
call sub.msvcrt.dll_wcsncat
add esp, 0x10
push str.__s
lea ecx, [ebp - 0x624]
call fcn.004019d5
and dword [ebp - 4], 0
cmp byte [ebp + 8], bl
jne 0x401e47
lea ecx, [esi + 0x220]
cmp dword [ecx], 0
je 0x401e37
call fcn.004016b0
push 0x420788
lea ecx, [ebp - 0x624]
call fcn.004016e0
mov eax, dword [esi + 0x224]
push edi
push dword [eax]
lea ecx, [ebp - 0x624]
call fcn.004016e0
push 0x420770
lea ecx, [ebp - 0x624]
call fcn.004016e0
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x65c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x660]
push eax
mov dword [ebp - 0x660], 0x3c
mov dword [ebp - 0x65c], 0x540
mov dword [ebp - 0x654], 0x420764
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x401efa
cmp dword [ebp - 0x628], 0
je 0x401efa
push 0xbb8
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x640], 0x20
setg bl
test bl, bl
je 0x401efa
mov al, byte [ebp + 8]
mov byte [esi + 4], al
lea eax, [ebp - 0x620]
cmp dword [ebp - 0x624], eax
je 0x401f14
push dword [ebp - 0x624]
call fcn.0041e106
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov al, bl
pop ebx
call fcn.0041e7f6
leave
ret 4
Function at 0x405081
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esi + 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str._force80
mov word [esi + 0x12], ax
call edi
push eax
call sub.msvcrt.dll_wcsstr
pop ecx
test eax, eax
pop ecx
setne al
push str._force71
mov byte [esi + 0x228], al
call edi
push eax
call sub.msvcrt.dll_wcsstr
pop ecx
test eax, eax
pop ecx
setne al
push str._netapp
mov byte [esi + 0x229], al
call edi
push eax
call sub.msvcrt.dll_wcsstr
test eax, eax
setne al
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
mov byte [esi + 0x22a], al
jne 0x405115
push 0x2000
call fcn.0041c61a
test eax, eax
pop ecx
mov dword [esi + 0xc], eax
jne 0x405115
push str.Initialize:___failed._m_pBuffer__NULL_n
call sub.msvcrt.dll_wprintf
pop ecx
xor al, al
pop edi
pop esi
ret
mov ecx, esi
call fcn.00402b45
test al, al
je 0x405110
mov ecx, esi
call fcn.00405014
test al, al
je 0x405110
mov al, 1
jmp 0x405112
Function at 0x406e05
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x41f006
call fcn.0041e140
sub esp, 0x428
mov eax, dword [0x429e98]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
xor edi, edi
cmp esi, edi
mov ebx, ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x434], eax
jne 0x406e4d
mov eax, 0x80004003
jmp 0x40700e
push edi
lea ecx, [ebp - 0x41c]
call fcn.004019d5
mov eax, dword [ebx + 0x224]
push dword [eax]
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], edi
call fcn.004016e0
push esi
lea ecx, [ebp - 0x41c]
call fcn.004016e0
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x42c], ebx
je 0x406fab
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
inc esi
inc esi
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
mov dword [ebp - 0x424], eax
je 0x406f7b
push edi
lea ecx, [ebp - 0x420]
push ecx
push esi
push eax
push ebx
mov dword [ebp - 0x420], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406f43
cmp dword [ebp - 0x420], edi
jbe 0x406f43
sub esp, 0x40c
mov edi, esp
mov ecx, 0x103
lea esi, [ebp - 0x41c]
push str.RunSQLFile:__s_n
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_wprintf
mov ecx, dword [ebp - 0x430]
add esp, 0x410
push dword [ebp - 0x434]
push dword [ebp - 0x428]
push dword [ebp - 0x420]
push dword [ebp - 0x424]
call fcn.00406a7e
mov ebx, eax
xor edi, edi
jmp 0x406f65
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x406f55
call esi
mov ebx, eax
jmp 0x406f65
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x406f9d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x406f8d
call esi
mov ebx, eax
jmp 0x406f9d
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406ff2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x406fbd
call esi
mov ebx, eax
jmp 0x406fcd
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
sub esp, 0x40c
mov edi, esp
mov ecx, 0x103
lea esi, [ebp - 0x41c]
push str.RunSQLFile:_File_not_found____s_n
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_wprintf
add esp, 0x410
lea eax, [ebp - 0x418]
cmp dword [ebp - 0x41c], eax
je 0x40700c
push dword [ebp - 0x41c]
call fcn.0041e106
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041e7f6
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4075f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x74]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
mov esi, reloc.OLEAUT32.dll_VariantClear
mov dword [esp + 0x24], 0
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x407718
push ebp
push 0x801
call dword [sym.imp.msvcrt.dll_malloc]
lea edx, [esp + 0x14]
push edx
mov esi, eax
call fcn.0040ccf0
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 8
push ebx
push 0
lea eax, [esp + 0x14]
push eax
push 0x800
push esi
push edi
call ebp
mov ebx, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x407683
push eax
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.0040e5b0
add esp, 0xc
test ebx, ebx
jne 0x407656
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
push edx
call fcn.0040e680
mov esi, eax
add esp, 4
test esi, esi
je 0x407720
mov edi, dword [esp + 0x80]
test edi, edi
je 0x407720
mov ebx, dword [esp + 0x74]
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x84]
push 1
push eax
push ecx
push edi
push esi
push 2
call fcn.00410b30
mov ebp, dword [esp + 0x90]
add esp, 4
push eax
push ebp
call fcn.0040fd20
mov ecx, dword [esp + 0xa0]
mov edx, dword [ecx]
add esp, 0x1c
cmp edx, 0x2c
jae 0x40770c
mov edx, dword [ebx + 4]
push 1
push edx
push ecx
push edi
push esi
push 2
call fcn.00410b30
add esp, 4
push eax
push ebp
call fcn.0040fd20
add esp, 0x1c
test eax, eax
jne 0x407720
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x60
ret
pop edi
mov eax, esi
pop esi
add esp, 0x60
ret
pop ebx
pop ebp
pop edi
mov eax, reloc.OLEAUT32.dll_VariantClear
pop esi
add esp, 0x60
ret
Function at 0x407730
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x6c]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
mov esi, reloc.OLEAUT32.dll_VariantClear
mov dword [esp + 0x24], 0
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407824
push ebp
push edi
push 0x801
call dword [sym.imp.msvcrt.dll_malloc]
lea edx, [esp + 0x18]
push edx
mov esi, eax
call fcn.0040ccf0
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 8
push 0
lea eax, [esp + 0x14]
push eax
push 0x800
push esi
push ebx
call ebp
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4077c3
push eax
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.0040e5b0
add esp, 0xc
test edi, edi
jne 0x407796
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
push edx
call fcn.0040e680
add esp, 4
test eax, eax
pop edi
pop ebp
je 0x407819
mov edx, dword [eax]
mov ecx, dword [esp + 0x70]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [esp + 0x74]
pop esi
mov dword [ecx], 0x14
xor eax, eax
pop ebx
add esp, 0x60
ret
pop esi
mov eax, reloc.OLEAUT32.dll_VariantClear
pop ebx
add esp, 0x60
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x60
ret

Function at 0x4078c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x60
mov eax, dword [esp + 0x6c]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov esi, reloc.OLEAUT32.dll_VariantClear
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4079b5
push ebp
push edi
push 0x801
call dword [sym.imp.msvcrt.dll_malloc]
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
call fcn.0040ccf0
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 8
lea esp, [esp]
push 0
lea edx, [esp + 0x14]
push edx
push 0x800
push esi
push ebx
call ebp
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40794d
push eax
lea eax, [esp + 0x18]
push esi
push eax
call fcn.0040e5b0
add esp, 0xc
test edi, edi
jne 0x407920
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
call fcn.0040e680
add esp, 4
test eax, eax
pop edi
pop ebp
je 0x4079aa
mov esi, dword [esp + 0x78]
test esi, esi
je 0x4079aa
push 1
push eax
push 2
call fcn.00410b30
mov edx, dword [esp + 0x88]
add esp, 4
push eax
mov eax, dword [esp + 0x7c]
push edx
push esi
push eax
call fcn.0040efb0
add esp, 0x18
cmp eax, 1
jne 0x4079aa
pop esi
xor eax, eax
pop ebx
add esp, 0x60
ret
pop esi
mov eax, reloc.OLEAUT32.dll_VariantClear
pop ebx
add esp, 0x60
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x60
ret
Function at 0x409c50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
xor eax, eax
push ebx
push ebp
mov dword [esp + 0x15], eax
push esi
mov esi, dword [esp + 0x28]
test esi, esi
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
push edi
mov ebp, reloc.OLEAUT32.dll_VariantClear
mov byte [esp + 0x1c], 0
mov byte [esp + 0x27], al
je 0x409e27
mov edi, dword [esp + 0x34]
test edi, edi
je 0x409e27
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x409e27
mov edx, dword [esp + 0x30]
mov ecx, edx
and ecx, 7
jbe 0x409cac
mov eax, 8
sub eax, ecx
jmp 0x409cae
xor eax, eax
lea ecx, [eax + edx + 0xc]
cmp dword [ebx], ecx
jb 0x409e27
mov ecx, dword [esi]
mov eax, 0x42302c
cmp ecx, dword [eax]
mov dword [esp + 0x10], 1
jne 0x409cec
mov ecx, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov dword [ebx], edx
mov eax, 1
pop ebx
add esp, 0x18
ret
mov ecx, dword [0x429400]
mov eax, 0x4f5045
mov ebx, edi
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov eax, 0xfffffff4
sub eax, edi
mov dword [ebx + 8], edx
mov dword [esp + 0x14], 0xc
lea ebx, [edi + 0xc]
mov dword [esp + 0x18], eax
jmp 0x409d20
add eax, ebx
cmp eax, edx
jae 0x409e1d
mov ecx, edx
sub ecx, eax
cmp ecx, 8
jb 0x409d41
mov ecx, dword [eax + esi]
mov dword [ebx], ecx
mov edx, dword [eax + esi + 4]
mov dword [ebx + 4], edx
jmp 0x409d5a
add esi, eax
mov eax, ecx
xor edx, edx
mov edi, ebx
mov dword [edi], edx
shr ecx, 2
mov dword [edi + 4], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, 0x54
xor eax, eax
mov edi, edi
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
inc eax
cmp eax, 8
mov cl, dl
jb 0x409d60
mov eax, dword [0x429400]
sub eax, 0
je 0x409ddb
dec eax
je 0x409dcc
dec eax
jne 0x409e18
mov eax, dword [0x42a37c]
test eax, eax
jne 0x409db1
push 0x42a1e0
push 0x422f00
call fcn.004071d0
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
je 0x409ded
mov dword [0x42a37c], 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409ded
push ebx
push ebx
push 0x42a1e0
call fcn.0040c8d0
add esp, 0xc
xor ebp, ebp
jmp 0x409df1
push 8
push ebx
push 0x422f00
call fcn.004081f0
jmp 0x409de8
push 8
push ebx
push 0x422f00
call fcn.00409260
add esp, 0xc
mov ebp, eax
test ebp, ebp
jl 0x409e1d
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add edx, 8
add ebx, 8
test eax, eax
mov dword [esp + 0x14], edx
je 0x409e1d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
jmp 0x409d20
mov ebp, reloc.OLEAUT32.dll_VariantClear
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
mov dword [ecx], edx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x409e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, reloc.OLEAUT32.dll_VariantClear
je 0x409e78
test edi, edi
je 0x409e78
mov eax, dword [esp + 0x34]
test eax, eax
je 0x409e78
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax]
add ecx, 0xfffffff4
cmp edx, ecx
jb 0x409e78
mov ebp, 1
jmp 0x409e7a
xor ebp, ebp
test ebp, ebp
mov edx, ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
je 0x409ff3
lea eax, [esp + 0x18]
push 0x42302c
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x409ee0
mov eax, dword [esp + 0x2c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
add esp, 0x14
ret
test ebp, ebp
je 0x409ff3
mov eax, 0xc
sub eax, edi
mov dword [esp + 0x14], eax
jmp 0x409f00
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
lea ecx, [ecx]
mov ecx, dword [esp + 0x2c]
add eax, edi
cmp eax, ecx
jae 0x409fcd
mov edx, dword [eax + ebx]
mov dword [edi], edx
mov eax, dword [eax + ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x1c]
sub eax, 0
je 0x409f81
dec eax
je 0x409f72
dec eax
je 0x409f30
mov esi, reloc.OLEAUT32.dll_VariantClear
jmp 0x409f93
mov eax, dword [0x42a51c]
test eax, eax
jne 0x409f5b
push 0x42a380
push 0x422f00
call fcn.004071d0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x409f93
mov dword [0x42a51c], 1
test ebp, ebp
je 0x409f93
push edi
push edi
push 0x42a380
call fcn.0040c940
add esp, 0xc
xor esi, esi
jmp 0x409f93
push 8
push edi
push 0x422f00
call fcn.00408290
jmp 0x409f8e
push 8
push edi
push 0x422f00
call fcn.004092f0
add esp, 0xc
mov esi, eax
mov dl, 0x54
xor eax, eax
mov cl, byte [edi + eax]
mov bl, cl
xor bl, dl
mov byte [edi + eax], bl
inc eax
cmp eax, 8
mov dl, cl
jb 0x409f97
test esi, esi
jl 0x409fcd
mov edx, dword [esp + 0x10]
add edx, 8
add edi, 8
test ebp, ebp
mov dword [esp + 0x10], edx
jne 0x409ef5
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
test ebp, ebp
je 0x409ff3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jbe 0x409fed
mov edx, dword [esp + 0x34]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40a000
Capabilities:
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x10
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x1c]
xor eax, eax
cmp esi, ebp
setne al
mov dword [esp + 8], ebp
mov dword [esp + 0xc], reloc.OLEAUT32.dll_VariantClear
cmp eax, ebp
je 0x40a178
push ebx
push edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
push 0x80
push 3
push ebp
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov esi, eax
cmp esi, ebp
je 0x40a144
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edi, eax
cmp ecx, edi
sbb esi, esi
neg esi
je 0x40a144
lea edx, [edi + 1]
push edx
call dword [sym.imp.msvcrt.dll_malloc]
mov ebp, eax
xor eax, eax
add esp, 4
test ebp, ebp
setne al
mov esi, eax
test esi, esi
je 0x40a144
push 0
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a0b1
cmp dword [esp + 0x18], edi
je 0x40a0b8
xor esi, esi
jmp 0x40a144
lea esi, [edi + 0x14]
push esi
call dword [sym.imp.msvcrt.dll_malloc]
xor edx, edx
add esp, 4
test eax, eax
setne dl
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], eax
mov esi, edx
test esi, esi
je 0x40a144
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
push ecx
push edi
push ebp
push 0
call fcn.0040aba0
xor edx, edx
add esp, 0x14
test eax, eax
setge dl
mov dword [esp + 0x14], eax
mov esi, edx
test esi, esi
je 0x40a144
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a13b
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
jne 0x40a13b
mov esi, 1
jmp 0x40a13d
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp ebx, 0xffffffff
je 0x40a150
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
mov edi, dword [sym.imp.msvcrt.dll_free]
je 0x40a160
push ebp
call edi
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40a16e
push eax
call edi
add esp, 4
test esi, esi
mov eax, dword [esp + 0x14]
pop edi
pop ebx
jne 0x40a17d
mov eax, reloc.OLEAUT32.dll_VariantClear
pop esi
pop ebp
add esp, 0x10
ret