joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4586c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463666
mov eax, dword fs:[0]
push eax
mov eax, 0x1034
call fcn.0044e520
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea ecx, [ebp - 0x30]
call fcn.004024b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401560
push str.OpenWithProgids
lea ecx, [ebp - 0x30]
call fcn.00401560
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
lea ecx, [ebp - 0x30]
call fcn.00401d50
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x458802
mov dword [ebp - 0x34], 0
jmp 0x458759
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x103c], ax
push 0xffe
push 0
lea ecx, [ebp - 0x103a]
push ecx
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x38], 0x800
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x103c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4587a6
jmp 0x4587f8
movzx eax, word [ebp - 0x103c]
test eax, eax
je 0x4587f3
lea ecx, [ebp - 0x103c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00458370
add esp, 8
movzx eax, al
test eax, eax
je 0x4587f3
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x103d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004026a0
mov al, byte [ebp - 0x103d]
jmp 0x45881e
jmp 0x458750
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x103e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004026a0
mov al, byte [ebp - 0x103e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret
Function at 0x4043b4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x45d350]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x28], eax
mov eax, dword [0x45d354]
push esi
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.004043ad
mov eax, dword [0x45d358]
add dword [ebp - 4], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x45d35c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x28577b4]
cmp eax, 0xfa9
jne 0x404435
mov dword [0x28577b0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404443
and dword [0x285723c], 0
mov edx, dword [ebp - 4]
add edx, ebx
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov dword [0x28577ac], 0xf4ea3dee
xor eax, edx
xor eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
sub edi, eax
mov eax, edi
shr eax, 5
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x28]
xor esi, edx
cmp dword [0x28577b4], 0xb03
jne 0x4044a8
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
xor eax, esi
sub ebx, eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 4], eax
dec dword [ebp - 0x14]
jne 0x404409
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
leave
ret 4

Function at 0x4044cd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x28577b4]
mov ecx, dword [0x2857240]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x40459f
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x28577b4], 0x959
jne 0x40458d
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403ee0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403f2c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0x403f58
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push 0x403f74
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.004043b4
add edi, 8
dec ebx
jne 0x4044f5
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40489a
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.00412130
push ebx
push esi
xor esi, esi
cmp dword [0x28577b4], 0x400
push edi
jne 0x4049a2
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x814]
push eax
push 0x404184
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0x4041a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
push esi
call fcn.00405800
push esi
push esi
call fcn.00405129
push esi
call fcn.00405785
add esp, 0x14
push esi
call fcn.00405a9a
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404c60
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404de0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405270
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404f10
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004054d0
fstp st(0)
push esi
call fcn.00405b0e
add esp, 0xc
push esi
push esi
call fcn.0040502d
push esi
call fcn.004058ad
add esp, 0xc
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0xacd
jge 0x4049c8
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be410
jg 0x4049ea
inc edi
cmp edi, 0x33309e9
jl 0x4049aa
xor edi, edi
cmp edi, 0x16d2a
jge 0x4049fb
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x404a19
inc edi
cmp edi, 0x3011b
jl 0x4049ec
mov eax, dword [0x45fc94]
mov dword [0x28577b4], eax
call fcn.004045a2
mov edi, 0x2ec37
cmp dword [0x28577b4], 0x51f
jne 0x404a45
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x404a2d
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407d4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c7dc]
jne 0x407d56
repz ret
jmp fcn.0040cf3c
Function at 0x41123a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45c7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040675a
and dword [ebp - 0x14], 0
cmp dword [0x4747a4], 0
mov dword [ebp - 0x18], eax
jne 0x4112ed
push 0x403e90
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411395
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e84
push ebx
call edi
test eax, eax
je 0x411395
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e74
push ebx
mov dword [0x4747a4], eax
call edi
push eax
call esi
push 0x403e60
push ebx
mov dword [0x4747a8], eax
call edi
push eax
call esi
push 0x403e44
push ebx
mov dword [0x4747ac], eax
call edi
push eax
call esi
mov dword [0x4747b4], eax
test eax, eax
je 0x4112ed
push 0x403e2c
push ebx
call edi
push eax
call esi
mov dword [0x4747b0], eax
mov eax, dword [0x4747b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411346
cmp dword [0x4747b4], ecx
je 0x411346
push eax
call esi
push dword [0x4747b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411346
test ebx, ebx
je 0x411346
call edi
test eax, eax
je 0x41133d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41133d
test byte [ebp - 8], 1
jne 0x411346
or dword [ebp + 0x10], 0x200000
jmp 0x411379
mov eax, dword [0x4747a8]
cmp eax, dword [ebp - 0x18]
je 0x411379
push eax
call esi
test eax, eax
je 0x411379
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411379
mov eax, dword [0x4747ac]
cmp eax, dword [ebp - 0x18]
je 0x411379
push eax
call esi
test eax, eax
je 0x411379
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4747a4]
call esi
test eax, eax
je 0x411395
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411397
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407d4c
leave
ret
Function at 0x401ccb
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00404590
mov dword [esp], eax
mov eax, dword [0x40b360]
push eax
push eax
call fcn.004066b2
lea ecx, [esp + 8]
pop edx
call fcn.00403100
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [0x40b360]
push eax
push eax
push dword [esp + 8]
call fcn.004045b0
lea ecx, [0x40b0c0]
pop edx
call fcn.00403100
push dword [esp]
call fcn.00404600
push dword [0x40b0c0]
call fcn.00406620
push dword [0x40b0c0]
call fcn.00406713
mov eax, dword [0x40b360]
push eax
push eax
call fcn.00406555
lea ecx, [0x40b0bc]
pop edx
call fcn.00403100
mov eax, dword [esp + 0x14]
call fcn.00404620
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401d94
mov edx, dword [0x40b0c0]
push dword [0x40b360]
call fcn.00407cf0
lea ecx, [0x40b0bc]
pop edx
call fcn.00403100
mov dword [esp + 0xc], 2
jmp 0x401da6
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401da6
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404620
mov dword [0x40b0b4], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404620
mov dword [0x40b0b8], eax
mov eax, 1
jmp 0x401dd9
push dword [esp + 4]
call fcn.00407d50
add esp, 0xc
pop ebx
ret 4
Function at 0x402144
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004030f0
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402195
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_LoadResource
mov dword [0x40b104], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x40b100], eax
mov eax, dword [esp + 4]
jmp 0x40219d
push dword [esp]
call fcn.00407d50
add esp, 8
ret 8
Function at 0x403aea
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b02
push dword [esp + 4]
push 0x403a83
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b3f
push esi
mov esi, dword [0x40b16c]
test esi, esi
je 0x403b3e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b36
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b16c
call fcn.0040701d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b0f
pop edi
pop ebx
pop esi
ret 4
Function at 0x404457
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x4044fb
mov eax, dword [ebp - 0xc]
dec eax
je 0x4044de
dec eax
jne 0x4044fb
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x4044da
dec eax
je 0x4044d6
dec eax
je 0x4044bc
dec eax
jne 0x4044fb
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x4044fb
cmp byte [ebp - 0x1e], 1
je 0x4044fb
push 0x4b
jmp 0x4044fa
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4044d2
dec eax
je 0x4044ce
dec eax
jne 0x4044fb
push 0x41
jmp 0x4044fa
push 0x3c
jmp 0x4044fa
push 0x32
jmp 0x4044fa
push 0x14
jmp 0x4044fa
push 5
jmp 0x4044fa
cmp dword [ebp - 0x14], 0
je 0x4044f8
cmp dword [ebp - 0x14], 0xa
je 0x4044f4
cmp dword [ebp - 0x14], 0x5a
jne 0x4044fb
push 0x28
jmp 0x4044fa
push 0x1e
jmp 0x4044fa
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x404d7c
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b3d4]
call fcn.00406e90
mov edi, eax
test edi, edi
je 0x404dde
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404da5
push dword [esp + 0xc]
push edi
call eax
jmp 0x404dde
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00407f00
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00408030
pop esi
pop ebx
pop edi
ret 8
Function at 0x4064bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40652a
push 0x11
call esi
test al, al
js 0x40652a
push 0x10
call esi
test al, al
js 0x40652a
push 0x12
call esi
test al, al
js 0x40652a
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40652a
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40654e
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40654e
dec eax
push eax
push dword [0x40b3dc]
call fcn.00406e90
mov eax, dword [eax + 8]
jmp 0x406550
xor eax, eax
pop esi
leave
ret 4

Function at 0x406713
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406786
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406768
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406766
cmp dl, 0x5c
je 0x406766
cmp dl, 0x2f
jne 0x406772
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406752
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x406788
xor eax, eax
leave
ret 4

Function at 0x406790
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4067c5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406a50
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406a99
cmp byte [esi], al
je 0x406a99
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b3ec]
push eax
push ecx
call fcn.00406e90
test eax, eax
je 0x406ac7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x406aa0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406a85
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406b30
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406aa0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x406ad0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406b29
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406b28
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b3ec]
push eax
push ecx
call fcn.00406e90
test eax, eax
je 0x406b24
cmp dword [eax + 4], 0
je 0x406b12
push esi
push edi
push eax
call fcn.00406b30
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406b30
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406b65
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x406bde
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x406bcb
sub ecx, 1
je 0x406bb6
sub ecx, 2
je 0x406ba3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00406790
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x406c0b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x407160
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x407315
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x407314
mov eax, dword [0x40b090]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x40730c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x4072ce
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x4071f0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x4072ef
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090f8]
add eax, 1
sub edi, 1
jne 0x4072d2
cmp edx, 0x1000
je 0x4071c0
mov edx, dword [0x40b090]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x407320
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret